Security Bulletin: IBM InfoSphere Information Server is affected by a remote code execution vulnerability in HSQLDB (CVE-2022-41853)

2022-12-0515:55:42

www.ibm.com

ibm infosphere information server

hsqldb

remote code execution

vulnerability

cve-2022-41853

java sql

preparedstatement

cvss

infosphere information server on cloud

datadirect odbc drivers version 7.1.6

jdbc drivers

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.013

Percentile

85.7%

JSON

Summary

A remote code execution vulnerability in HSQLDB used by IBM InfoSphere Information Server was addressed.

Vulnerability Details

CVEID:CVE-2022-41853
**DESCRIPTION:**HSQLDB could allow a remote attacker to execute arbitrary code on the system, caused by improper validation of user-supplied input by the java.sql.Statement or java.sql.PreparedStatement components. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/237983 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H)

Affected Products and Versions

Affected Product(s)	Version(s)
InfoSphere Information Server	11.7

Remediation/Fixes

Product	VRMF	APAR	Remediation
InfoSphere Information Server, InfoSphere Information Server on Cloud	11.7

DT173144

DT172944

| --Upgrade to DataDirect ODBC drivers version 7.1.6
--Use Technote to choose which OpenSSL version the drivers will use
--Use Technote to follow additional post installation configuration steps

--Update JDBC drivers