Security Bulletin: Due to use of Spring Framework, IBM Db2 Web Query for i is vulnerable to unprotected fields (CVE-2022-22968), remote code execution (CVE-2022-22965), and denial of service (CVE-2022-22950).


## Summary There are multiple vulnerabilities in Spring Framework (CVE-2022-22968, CVE-2022-22965, and CVE-2022-22950) as described in the vulnerability details section. Spring Framework v5.3.8 is used by Db2 Web Query for i for infrastructure support. IBM has addressed the vulnerabilities in Db2 Web Query for i by upgrading to Spring Framework v5.3.19. ## Vulnerability Details ** CVEID: **[CVE-2022-22968](<https://vulners.com/cve/CVE-2022-22968>) ** DESCRIPTION: **Spring Framework could provide weaker than expected security, caused by a data binding rules vulnerability in which the patterns for disallowedFields on a DataBinder are case sensitive. The case sensitivity allows that a field is insufficiently protected unless it is listed with both upper and lower case for the first character of the field. An attacker could exploit this vulnerability to launch further attacks on the system. CVSS Base score: 3.7 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/224374](<https://exchange.xforce.ibmcloud.com/vulnerabilities/224374>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) ** CVEID: **[CVE-2022-22965](<https://vulners.com/cve/CVE-2022-22965>) ** DESCRIPTION: **Spring Framework could allow a remote attacker to execute arbitrary code on the system, caused by the improper handling of PropertyDescriptor objects used with data binding. By sending specially-crafted data to a Spring Java application, an attacker could exploit this vulnerability to execute arbitrary code on the system. Note: The exploit requires Spring Framework to be run on Tomcat as a WAR deployment with JDK 9 or higher using spring-webmvc or spring-webflux. Note: This vulnerability is also known as Spring4Shell or SpringShell. CVSS Base score: 9.8 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/223103](<https://exchange.xforce.ibmcloud.com/vulnerabilities/223103>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) ** CVEID: **[CVE-2022-22950](<https://vulners.com/cve/CVE-2022-22950>) ** DESCRIPTION: **VMware Tanzu Spring Framework is vulnerable to a denial of service, caused by improper input validation. By sending a specially-crafted crafted SpEL expression, a remote attacker could exploit this vulnerability to cause a denial of service condition. CVSS Base score: 5.4 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/223096](<https://exchange.xforce.ibmcloud.com/vulnerabilities/223096>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) ## Affected Products and Versions Affected Product(s)| Version(s) ---|--- IBM Db2 Web Query for i| 2.3.0 IBM Db2 Web Query for i| 2.2.1 ## Remediation/Fixes **IBM strongly recommends addressing the vulnerabilities now.** Db2 Web Query for i releases 2.2.1 and 2.3.0 are impacted. **Release 2.2.1 can be fixed by upgrading to release 2.3.0.** To request an EZ-Install package, including instructions for the upgrade installation, send an email to [QU2@us.ibm.com](<mailto:QU2@us.ibm.com>). More information for the upgrade is available at <https://ibm.biz/db2wq-install>. **Release 2.3.0 can be fixed by applying the latest Db2 Web Query for i group Program Temporary Fix (PTF).** The PTFs are applied to product ID 5733WQX. The group PTF numbers and minimum level with the fix are: **Affected Releases** | **Group PTF and Minimum Level for Remediation** ---|--- Db2 Web Query for i 2.3.0 w/ IBM i 7.5 | [SF99671 level 6](<https://www.ibm.com/support/fixcentral/ibmi/quickorder?function=IBMiFixId&fixids=SF99671&includeSupersedes=0&source=fc> "SF99671 level 6" ) Db2 Web Query for i 2.3.0 w/ IBM i 7.4 | [SF99654 level 6](<https://www.ibm.com/support/fixcentral/ibmi/quickorder?function=IBMiFixId&fixids=SF99654&includeSupersedes=0&source=fc>) Db2 Web Query for i 2.3.0 w/ IBM i 7.3 | [SF99533 level 6](<https://www.ibm.com/support/fixcentral/ibmi/quickorder?function=IBMiFixId&fixids=SF99533&includeSupersedes=0&source=fc>) _**Important note:** __IBM recommends that all users running unsupported versions of affected products upgrade to supported and fixed version of affected products._ ## Workarounds and Mitigations None ##

Affected Software

CPE Name Name Version
ibm i 7.2 7.2
ibm i 7.1 7.1
ibm i 7.4 7.4
db2 web query for i 2.3.0
db2 web query for i 2.2.1
ibm i 7.5
ibm i 7.4
ibm i 7.3
ibm i 7.2
ibm i 7.1
ibm i 7.3 7.3