Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM® Db2®. (Oct 2023 CPU)

Summary

There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 7.1.5.19 and earlier, 8.0.8.11 and earlier used by IBM® Db2®. These issues were disclosed as part of the IBM Java SDK updates in October 2023.

Vulnerability Details

CVEID:CVE-2023-22081
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the JSSE component could allow a remote attacker to cause no confidentiality impact, no integrity impact, and low availability impact.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/268929 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:CVE-2023-5676
**DESCRIPTION:**Eclipse OpenJ9 is vulnerable to a denial of service, caused by a flaw when a shutdown signal (SIGTERM, SIGINT or SIGHUP) is received before the JVM has finished initializing. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause an infinite busy hang on a spinlock or a segmentation fault.
CVSS Base score: 4.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/271615 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

10.5.0.x

|

Client and Server

IBM® Db2®|

11.1.4.x

|

Client and Server

IBM® Db2®|

11.5.x

|

Client and Server

All platforms are affected.
Earlier releases (10.1, 9.7 etc.) may also be affected, but they are no longer supported.

Remediation/Fixes

The recommended solution is to apply the appropriate fix for this vulnerability.

The fix for this vulnerability is in the latest version of IBM JDK.

Affected IBM SDK, Java Technology Edition, Version:

• 7.1.5.19 and earlier
• 8.0.8.11 and earlier
• Earlier releases (7.0, 6, 5.0, 1.4.2, 1.3.1, 1.2.2 etc.) may also be affected, but they are no longer supported.

Fixes for applicable vulnerabilities are included in IBM SDK, Java Technology Edition:

• 8.0.8.15 for all Db2 releases

Customers running any vulnerable fixpack level of an affected Program, V10.5, V11.1 or V11.5, can download the latest version of IBM JDK from Fix Central.

Instructions for IBM JDK Installation can be found here:
<http://www.ibm.com/support/docview.wss?uid=swg27050993&gt;

IBM does not disclose key Db2 functionality nor replication steps for a vulnerability to avoid providing too much information to any potential malicious attacker. IBM does not want to enable a malicious attacker with sufficient knowledge to craft an exploit of the vulnerability.

Workarounds and Mitigations

None