Security Bulletin: Multiple security vulnerabilities have been identified in IBM Db2 shipped with IBM Security Guardium Key Lifecycle Manager

Summary

IBM Db2 is shipped as a component of IBM Security Key Lifecycle Manager (SKLM/GKLM). Information about multiple security vulnerabilities affecting IBM Db2 has been published in a security bulletin.

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Principal Product and Version(s)

| Affected Supporting Product and Version
—|—
IBM Security Key Lifecycle Manager (SKLM) v3.0| IBM Db2 11.1.2.2
IBM Security Key Lifecycle Manager (SKLM) v3.0.1| IBM Db2 11.1.2.2
IBM Security Key Lifecycle Manager (SKLM) v4.0| IBM Db2 11.1.4.4
IBM Security Guardium Key Lifecycle Manager (GKLM) v4.1| IBM Db2 11.5.4
IBM Security Guardium Key Lifecycle Manager (GKLM) v4.1.1| IBM Db2 11.5.8
IBM Security Guardium Key Lifecycle Manager (GKLM) v4.2| IBM Db2 11.5.8
IBM Security Guardium Key Lifecycle Manager (GKLM) v4.2.1| IBM Db2 11.5.9

Remediation/Fixes

IBM encourages customers to update their systems promptly.

1. Security Bulletin: IBM® Db2® is vulnerable to denial of service with a specially crafted query (CVE-2023-47158)

Please consult following security bulletins from IBM Db2 for more detail:

IBM® Db2® is vulnerable to denial of service with a specially crafted query (CVE-2023-47158)

2. IBM® Db2® is vulnerable to a privilege escalation to SYSTEM user via MSI repair functionality on Windows (CVE-2023-47145)

Please consult following security bulletins from IBM Db2 for more detail:

IBM® Db2® is vulnerable to a privilege escalation to SYSTEM user via MSI repair functionality on Windows (CVE-2023-47145)

3. IBM® Db2® is vulnerable to a denial of service when using a specially crafted query (CVE-2023-47747)

Please consult following security bulletins from IBM Db2 for more detail:

IBM® Db2® is vulnerable to a denial of service when using a specially crafted query (CVE-2023-47747)

4. IBM® Db2® is vulnerable to remote code execution caused by installing like-named jar files across multiple databases. (CVE-2023-27859)

Please consult following security bulletins from IBM Db2 for more detail:

IBM® Db2® is vulnerable to remote code execution caused by installing like-named jar files across multiple databases. (CVE-2023-27859)

5. IBM® Db2® is vulnerable to a denial of service when a specially crafted query is used (CVE-2023-47746)

IBM Security Key Lifecycle Manager (SKLM) v3.0.1
IBM Security Key Lifecycle Manager (SKLM) v4.0
IBM Security Key Lifecycle Manager (SKLM) v4.1
IBM Security Key Lifecycle Manager (SKLM) v4.1.1
IBM Security Key Lifecycle Manager (SKLM) v4.2
IBM Security Key Lifecycle Manager (SKLM) v4.2.1

Please consult following security bulletins from IBM Db2 for more detail:

IBM® Db2® is vulnerable to a denial of service when a specially crafted query is used (CVE-2023-47746)

6. IBM® Db2® is vulnerable to an insecure cryptographic algorithm and to information disclosure in stack trace under exceptional conditions. (CVE-2023-47152)

Please consult following security bulletins from IBM Db2 for more detail:

IBM® Db2® is vulnerable to an insecure cryptographic algorithm and to information disclosure in stack trace under exceptional conditions. (CVE-2023-47152)

7. IBM® Db2® is vulnerable to denial of service with a specially crafted query (CVE-2023-47141)

Please consult following security bulletins from IBM Db2 for more detail:

IBM® Db2® is vulnerable to denial of service with a specially crafted query (CVE-2023-47141)

8. IBM® Db2® Federated is affected by a vulnerability in the consumed open source presto-jdbc library that may lead to information disclosure

Please consult following security bulletins from IBM Db2 for more detail:

IBM® Db2® Federated is affected by a vulnerability in the consumed open source presto-jdbc library that may lead to information disclosure

9. IBM® Db2® is vulnerable to a denial of service when a specially crafted cursor is used. (CVE-2023-45193)

Please consult following security bulletins from IBM Db2 for more detail:

IBM® Db2® is vulnerable to a denial of service when a specially crafted cursor is used. (CVE-2023-45193)

10. IBM® Db2® is vulnerable to a denial of service when a statement is run on columnar tables under specific conditions (CVE-2023-50308)

Please consult following security bulletins from IBM Db2 for more detail:

IBM® Db2® is vulnerable to a denial of service when a statement is run on columnar tables under specific conditions (CVE-2023-50308)

Workarounds and Mitigations

None