Security Bulletin: IBM Db2 Web Query for i is vulnerable to attacker obtaining sensitive information due to Java string processing in IBM Toolbox for Java (CVE-2022-43928)

Summary

Db2 Web Query uses the IBM Toolbox for Java to access IBM i interfaces. IBM Toolbox for Java could allow sensitive information stored as Java strings to be obtained by an attacker as described in the vulnerability details section. Db2 Web Query has addressed the vulnerability with a fix as described in the remediation/fixes section.

Vulnerability Details

CVEID:CVE-2022-43928
**DESCRIPTION:**The IBM Toolbox for Java could allow a user to obtain sensitive information, caused by utilizing a Java string for processing. Since Java strings are immutable, their contents exist in memory until garbage collected. This means sensitive data could be visible in memory over an indefinite amount of time. IBM has addressed this issue by reducing the amount of time the sensitive data is visible in memory.
CVSS Base score: 4.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/241675 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

2.3.0

IBM Db2 Web Query for i|

2.4.0

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now.

To remediate this problem you must apply PTFs to IBM Db2 Web Query for i (5733WQX) and must apply the latest level of the group PTF for IBM HTTP Server for i (5770DG1). Future Group PTFs for IBM HTTP Server for i will also contain the fixes for the vulnerability.

The PTF numbers containing the fix for this vulnerability are in the following table.

SI82122

SI82140

SI82141

| 7.5| SF99952 - 06
7.4| SF99662 - 26
7.3| SF99722 - 43
2.4.0|

SI82416

SI82119

SI82118

| 7.5| SF99952 - 06
7.4| SF99662 - 26

Important note:_
IBM recommends that all users running unsupported versions of affected products upgrade to a supported and fixed version of affected products._

Workarounds and Mitigations

None