Security Bulletin: IBM Security Guardium is affected by remote code execution and sensitive information vulnerabilities (CVE-2022-31684, CVE-2022-41853)

Summary

IBM Security Guardium has fixed these vulnerabilities by updating the affected components.

Vulnerability Details

CVEID:CVE-2022-31684
**DESCRIPTION:**Tanzu VMware Reactor Netty could allow a remote authenticated attacker to obtain sensitive information, caused by the log of request headers in some cases of invalid HTTP requests. By gaining access to the log file, an attacker could exploit this vulnerability to obtain valid access tokens information, and use this information to launch further attacks against the affected system.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/240579 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

CVEID:CVE-2022-41853
**DESCRIPTION:**HSQLDB could allow a remote attacker to execute arbitrary code on the system, caused by improper validation of user-supplied input by the java.sql.Statement or java.sql.PreparedStatement components. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/237983 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H)

Affected Products and Versions

Remediation/Fixes

IBM encourages customers to update their systems promptly.

IBM Security Guardium| 11.4|

IBM Security Guardium| 11.5|

| | http://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=11.0&platform=Linux&function=fixId&fixids=SqlGuard_11.0p520_Bundle_Feb-20-2023&includeSupersedes=0&source=fc

Workarounds and Mitigations

None