Security Bulletin: One or more security vulnerabilities has been identified in IBM® DB2® shipped with IBM PureData System for Operational Analytics (CVE-2022-43927,CVE-2022-43929)

Summary

IBM® DB2® is shipped as a component of IBM PureData System for Operational Analytics. Information about security vulnerabilities affecting IBM DB2 have been published in a security bulletin (CVE-2022-43927,CVE-2022-43929).

Vulnerability Details

CVEID:CVE-2022-43929
**DESCRIPTION:**IBM Db2 for Linux, UNIX and Windows 11.1 and 11.5 may be vulnerable to a Denial of Service when executing a specially crafted ‘Load’ command. IBM X-Force ID: 241676.
CVSS Base score: 4.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/241676 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2022-43927
**DESCRIPTION:**IBM Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 is vulnerable to information Disclosure due to improper privilege management when a specially crafted table access is used. IBM X-Force ID: 241671.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/241671 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

IBM PureData System for Operational Analytics V1.1 (A1801)

Remediation/Fixes

Determine the appliance fixpack level as root on the management server using the appl_ls_cat command.

$ appl_ls_cat -i
NAME VERSION STATUS DESCRIPTION
bwr3 4.0.8.0 Committed Updates for IBM_PureData_System_for_Operational_Analytics

Determine the version of Db2 used on the core nodes in the appliance. The command below shows that Version 10.5.0.11 is installed. The number of hosts, Db2 version and instance name are customer dependent. The appliance supports Db2 10.5 or Db2 11.1 and the default instance owner is bcuaix. The command below shows that the instance is used Db2 10.5.0.11.

$ dsh -n ${BCUALL} ‘/usr/local/bin/db2ls -c | grep -v “#” | cut -d: -f 1 | head -1 | while read p;do $p/bin/db2greg -dump | grep “^I”;done’| dshbak -c
HOSTS -------------------------------------------------------------------------
host02, host04, host05, hostflash06
-------------------------------------------------------------------------------
I,DB2,10.5.0.11,bcuaix,/db2home/bcuaix/sqllib,1,0,/usr/IBM/dwe/db2/V10.5.0.11…2,

Login as the instance owner to any of the host servers. The following command will show the build number installed.

$ db2level
DB21085I This instance or install (instance name, where applicable: “bcuaix”)
uses “64” bits and DB2 code release “SQL1005B” with level identifier
“060C010E”.
Informational tokens are “DB2 v10.5.0.11”, “special_40479”, “IP24071_40479”,
and Fix Pack “11”.
Product is installed at “/usr/IBM/dwe/db2/V10.5.0.11…2”.

Use the table below to determine how to download the Db2 Fixpack or Special Build and then refer to the appliance technote <https://www.ibm.com/support/pages/installing-db2-fix-pack-ibm-puredata-system-operational-analytics&gt; for instructions on how to apply the Db2 Fixpack or Special Build on the appliance. Contact IBM Support for any questions or concerns related to this update. The number in brackets will match version returned by the appl_ls_conf command.

Special Build 41247 for DB2 10.5 Fix Pack 11 for AIX (64 bit), DB2 Universal Fix Pack

Special Build 41246 for DB2 11.1.4 Fix Pack 7 for AIX (64 bit), DB2 Universal Fix Pack

V1.1 FP1 [ 4.0.5.x ]|

Special Build 41247 for DB2 10.5 Fix Pack 11 for AIX (64 bit), DB2 Universal Fix Pack

Special Build 41246 for DB2 11.1.4 Fix Pack 7 for AIX (64 bit), DB2 Universal Fix Pack

V1.1 FP2 [ 4.0.6.x ]|

Special Build 41247 for DB2 10.5 Fix Pack 11 for AIX (64 bit), DB2 Universal Fix Pack

Special Build 41246 for DB2 11.1.4 Fix Pack 7 for AIX (64 bit), DB2 Universal Fix Pack

V1.1 FP3 [ 4.0.7.x ]|

Special Build 41247 for DB2 10.5 Fix Pack 11 for AIX (64 bit), DB2 Universal Fix Pack

Special Build 41246 for DB2 11.1.4 Fix Pack 7 for AIX (64 bit), DB2 Universal Fix Pack

V1.1 FP4 [ 4.0.8.x ]|

Special Build 41247 for DB2 10.5 Fix Pack 11 for AIX (64 bit), DB2 Universal Fix Pack

Special Build 41246 for DB2 11.1.4 Fix Pack 7 for AIX (64 bit), DB2 Universal Fix Pack

V1.1 FP5 [ 4.0.9.x ]|

Special Build 41247 for DB2 10.5 Fix Pack 11 for AIX (64 bit), DB2 Universal Fix Pack

Special Build 41246 for DB2 11.1.4 Fix Pack 7 for AIX (64 bit), DB2 Universal Fix Pack

Workarounds and Mitigations

None