Security Bulletin: Multiple security vulnerabilities have been identified in IBM Db2 shipped with IBM Security Guardium Key Lifecycle Manager (April 2024)

Summary

IBM Db2 is shipped as a component of IBM Security Key Lifecycle Manager (SKLM/GKLM). Information about multiple security vulnerabilities affecting IBM Db2 has been published in a security bulletin.

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Principal Product and Version(s)

| Affected Supporting Product and Version
—|—
IBM Security Key Lifecycle Manager (SKLM) v4.0 | IBM Db2 11.1.4.4
IBM Security Guardium Key Lifecycle Manager (GKLM) v4.1 | IBM Db2 11.5.4
IBM Security Guardium Key Lifecycle Manager (GKLM) v4.1.1 | IBM Db2 11.5.8
IBM Security Guardium Key Lifecycle Manager (GKLM) v4.2 | IBM Db2 11.5.8
IBM Security Guardium Key Lifecycle Manager (GKLM) v4.2 | IBM Db2 11.5.9

Remediation/Fixes

1. IBM® Db2® is vulnerable to sensitive information disclosure when using ADMIN_CMD with IMPORT or EXPORT (CVE-2023-38729)

Please consult following security bulletins from IBM Db2 for more detail:

IBM® Db2® is vulnerable to sensitive information disclosure when using ADMIN_CMD with IMPORT or EXPORT (CVE-2023-38729)

2. IBM® Db2® is affected by a vulnerability in an open source library boost (CVE-2012-2677)

Only GKLM running on Linux platform is impacted.

Please consult following security bulletins from IBM Db2 for more detail:

IBM® Db2® is affected by a vulnerability in an open source library boost (CVE-2012-2677)

3. IBM® Db2® is vulnerable to an information disclosure vulnerability as sensitive information may be included in a log file (CVE-2024-25030)

Only GKLM 4.0 running on Linux platform is impacted.

Please consult following security bulletins from IBM Db2 for more detail:

IBM® Db2® is vulnerable to an information disclosure vulnerability as sensitive information may be included in a log file (CVE-2024-25030)

4. IBM® Db2® is vulnerable to denial of service with a specially crafted query (CVE-2024-25046)

AIX
Linux
Windows

IBM Security Key Lifecycle Manager (SKLM) v4.1 |

AIX
Linux
Windows

IBM Security Key Lifecycle Manager (SKLM) v4.1.1
IBM Security Key Lifecycle Manager (SKLM) v4.2
IBM Security Key Lifecycle Manager (SKLM) v4.2.1 |

AIX
Linux
Windows

Please consult following security bulletins from IBM Db2 for more detail:

IBM® Db2® is vulnerable to denial of service with a specially crafted query (CVE-2024-25046)

5. IBM® Db2® is vulnerable to denial of service with a specially crafted query under certain conditions (CVE-2024-27254)

Please consult following security bulletins from IBM Db2 for more detail:

IBM® Db2® is vulnerable to denial of service with a specially crafted query under certain conditions (CVE-2024-27254)

6. IBM® Db2® is vulnerable to denial of service when querying a specific UDF built-in function concurrently (CVE-2023-52296)

Please consult following security bulletins from IBM Db2 for more detail:

IBM® Db2® is vulnerable to denial of service when querying a specific UDF built-in function concurrently (CVE-2023-52296)

7. IBM® Db2® is vulnerable to a denial of service with a specially crafted query on certain columnar tables (CVE-2024-22360)

Please consult following security bulletins from IBM Db2 for more detail:

IBM® Db2® is vulnerable to a denial of service with a specially crafted query on certain columnar tables (CVE-2024-22360)

Workarounds and Mitigations

None