Security Bulletin: IBM Db2 Mirror for i is vulnerable to attacker obtaining sensitive information due to Java string processing in IBM Toolbox for Java (CVE-2022-43928)

Summary

IBM Db2 Mirror for i setup and GUI use the IBM Toolbox for Java to access IBM i interfaces. IBM Toolbox for Java could allow sensitive information stored as Java strings to be obtained by an attacker as described in the vulnerability details section. IBM Db2 Mirror for i has addressed the vulnerability with a fix as described in the remediation/fixes section.

Vulnerability Details

CVEID:CVE-2022-43928
**DESCRIPTION:**The IBM Toolbox for Java could allow a user to obtain sensitive information, caused by utilizing a Java string for processing. Since Java strings are immutable, their contents exist in memory until garbage collected. This means sensitive data could be visible in memory over an indefinite amount of time. IBM has addressed this issue by reducing the amount of time the sensitive data is visible in memory.
CVSS Base score: 4.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/241675 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now.

The vulnerability can be fixed by applying PTFs to IBM i. Releases 7.5 and 7.4 of IBM Db2 Mirror for i are supported and will be fixed.

The PTF numbers containing the fixes for this vulnerability are in the following table. Installing all PTFs is required for complete remediation. IBM recommends installing the group PTF rather than the individual fixes.

Affected Product(s)|Version(s)|**Group PTF Number
and Minimum Level
for Remediation **|5770-DBM PTF Numbers
for Remediation|

5770-SS1 PTF Numbers
for Remediation

—|—|—|—|—
IBM Db2 Mirror for i| 7.4|

SF99668 level 22

|

SI83019

SI83028

|

SI82444

SI82954

IBM Db2 Mirror for i| 7.5|

SF99951 level 4

|

SI83018

SI83029

|

SI82443

SI82948

<https://www.ibm.com/support/fixcentral&gt;

Important note: IBM recommends that all users running unsupported versions of affected products upgrade to supported and fixed version of affected products.

Workarounds and Mitigations

None