Security Bulletin: Multiple vulnerabilities in IBM DB2 affect IBM Operations Analytics Predictive Insights (CVE-2020-4230, CVE-2020-4135, CVE-2020-4200, CVE-2020-4161, CVE-2020-4204)

Summary

There are multiple vulnerabilities in IBM® DB2 used by IBM Operations Analytics Predictive Insights 1.3.6 and earlier. IBM Operations Analytics Predictive Insights has addressed the applicable CVEs.

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Remediation/Fixes

Please consult the security bulletin Security Bulletin: IBM® Db2® is vulnerable to privilege escalation (CVE-2020-4230) for vulnerability details and information about fixes.

Please consult the security bulletin IBM® Db2® is vulnerable to denial of service (CVE-2020-4135) for vulnerability details and information about fixes.

Please consult the security bulletin IBM® Db2® is vulnerable to denial of service (CVE-2020-4200) for vulnerability details and information about fixes.

Please consult the security bulletin Multiple buffer overflow vulnerabilities exist in IBM® Db2® leading to privilege escalation (CVE-2020-4204) for vulnerability details and information about fixes.

With Predictive Insights iFix 3, DB2 version 11.5.4 is supported and recommended. Alternatively, apply FP11 to DB2 version 10.5.

Workarounds and Mitigations

None