Security Bulletin: IBM DB2 used by IBM Security Verify Governance, Identity Manager virtual appliance component has multiple vulnerabilities

Summary

Information about security vulnerabilities affecting IBM DB2 has been published in security bulletins. IBM Security Verify Governance, Identity Manager virtual appliance component ships with IBM DB2.

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Remediation/Fixes

IBM encourages customers to update their systems promptly.

Principal Product and Version(s)

|

Affected Supporting Product and Version(s)

|

Affected Supporting Product Security Bulletin

—|—|—

ISVG 10.0.1

|

DB2 V10.5, V11.1, V11.5

|

Security Bulletin: IBM® Db2® is vulnerable to a denial of service as the server may crash when using a specially crafted subquery. ** **(CVE-2023-27559)

ISVG 10.0.1

|

DB2 V10.5, V11.1, V11.5

|

Security Bulletin: IBM® Db2® is vulnerable to a denial of service as the server may crash when an Out of Memory occurs. (CVE-2023-26022)

ISVG 10.0.1

|

DB2 V10.5, V11.1, V11.5

|

Security Bulletin: IBM® Db2® is vulnerable to a denial of service. Under rare conditions, setting a special register may cause the Db2 server to terminate abnormally. (CVE-2023-25930)

ISVG 10.0.1

|

DB2 V11.1, V11.5

|

Security Bulletin: IBM® Db2® is vulnerable to a denial of service as the server may crash when compiling a specially crafted SQL query using a LIMIT clause. (CVE-2023-26021)

ISVG 10.0.1

|

DB2 V11.5

|

Security Bulletin: IBM® Db2® is vulnerable to a denial of service as the server may crash when when attempting to use ACR client affinity for unfenced DRDA federation wrappers. (CVE-2023-27555)

ISVG 10.0.1|

DB2 V10.5, V11.1, V11.5

|

Security Bulletin: IBM® Db2® is vulnerable to a denial of service as as it may trap when compiling a variation of an anonymous block. (CVE-2023-29255)

ISVG 10.0.1|

DB2 V10.5, V11.1, V11.5

| Security Bulletin: IBM® Db2® is vulnerable to remote code execution as a database administrator of one database may execute code or read/write files from another database within the same instance. (CVE-2023-29257)

Workarounds and Mitigations

None