Lucene search

IBMB5A80FD23109C6F5FA566F55313D268016E6AF45B6AEA40A043FD0ED630D8848

HistorySep 12, 2024 - 5:50 a.m.

Security Bulletin: Multiple security vulnerabilities have been identified in IBM Db2 shipped with IBM Security Guardium Key Lifecycle Manager

2024-09-1205:50:58

www.ibm.com

ibm db2

security bulletin

vulnerabilities

ibm security guardium

key lifecycle manager

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

Confidence

High

JSON

Summary

IBM Db2 is shipped as a component of IBM Security Key Lifecycle Manager (SKLM/GKLM). Information about multiple security vulnerabilities affecting IBM Db2 has been published in a security bulletin.

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Security Guardium Key Lifecycle Manager	4.0, 4.1, 4.1.1, 4.2, 4.2.1

Principal Product and Version(s)

| Affected Supporting Product and Version
—|—
IBM Security Key Lifecycle Manager (SKLM) v4.0 | IBM Db2 11.1.4.4
IBM Security Guardium Key Lifecycle Manager (GKLM) v4.1 | IBM Db2 11.5.4
IBM Security Guardium Key Lifecycle Manager (GKLM) v4.1.1 | IBM Db2 11.5.8
IBM Security Guardium Key Lifecycle Manager (GKLM) v4.2 | IBM Db2 11.5.8
IBM Security Guardium Key Lifecycle Manager (GKLM) v4.2.1 | IBM Db2 11.5.9

Remediation/Fixes

Security Bulletin: IBM® Db2® is vulnerable to a denial of service as the server may crash when using a specially crafted query on columnar tables in a database partitioned environment (CVE-2024-31882) - GKLM/SKLM is not affected
Security Bulletin: IBM® Db2® is affected by vulnerabilities in the open source bcprov-jdk18on library (CVE-2024-30171, CVE-2024-30172, CVE-2024-29857)

Principal Product and Version(s)	Remediation/ Fixes
IBM Security Key Lifecycle Manager (SKLM) v4.0

Please consult following security bulletins from IBM Db2 for more detail:

Security Bulletin: IBM® Db2® is affected by vulnerabilities in the open source bcprov-jdk18on library (CVE-2024-30171, CVE-2024-30172, CVE-2024-29857)

IBM Security Key Lifecycle Manager (SKLM) v4.1
IBM Security Key Lifecycle Manager (SKLM) v4.1.1
IBM Security Key Lifecycle Manager (SKLM) v4.2
IBM Security Guardium Key Lifecycle Manager (GKLM) v4.2.1

Security Bulletin: IBM® Db2® federated server is vulnerable to a denial of service with a specially crafted query under certain conditions (CVE-2024-35136)

Principal Product and Version(s)	Remediation/ Fixes
IBM Security Key Lifecycle Manager (SKLM) v4.0

Please consult following security bulletins from IBM Db2 for more detail:

Security Bulletin: IBM® Db2® federated server is vulnerable to a denial of service with a specially crafted query under certain conditions (CVE-2024-35136)

Security Bulletin: IBM® Db2® is vulnerable to a denial of service when querying certain tables using a specially crafted statement (CVE-2024-35152)

Principal Product and Version(s)	Remediation/ Fixes
IBM Security Key Lifecycle Manager (SKLM) v4.0

Please consult following security bulletins from IBM Db2 for more detail:

Security Bulletin: IBM® Db2® is vulnerable to a denial of service when querying certain tables using a specially crafted statement (CVE-2024-35152)

Security Bulletin: IBM® Db2® is vulnerable to a denial of service with a specially crafted query (CVE-2024-37529)

Principal Product and Version(s)	Remediation/ Fixes
IBM Security Key Lifecycle Manager (SKLM) v4.0

Please consult following security bulletins from IBM Db2 for more detail:

Security Bulletin: IBM® Db2® is vulnerable to a denial of service with a specially crafted query (CVE-2024-37529)

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmsecurity_guardium_key_lifecycle_managerMatch4.0

ibmsecurity_guardium_key_lifecycle_managerMatch4.1

ibmsecurity_guardium_key_lifecycle_managerMatch4.1.1

ibmsecurity_guardium_key_lifecycle_managerMatch4.2

ibmsecurity_guardium_key_lifecycle_managerMatch4.2.1

VendorProductVersionCPE
ibmsecurity_guardium_key_lifecycle_manager4.0cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:4.0:*:*:*:*:*:*:*
ibmsecurity_guardium_key_lifecycle_manager4.1cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:4.1:*:*:*:*:*:*:*
ibmsecurity_guardium_key_lifecycle_manager4.1.1cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:4.1.1:*:*:*:*:*:*:*
ibmsecurity_guardium_key_lifecycle_manager4.2cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:4.2:*:*:*:*:*:*:*
ibmsecurity_guardium_key_lifecycle_manager4.2.1cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:4.2.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	security_guardium_key_lifecycle_manager	4.0	cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:4.0:::::::*
ibm	security_guardium_key_lifecycle_manager	4.1	cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:4.1:::::::*
ibm	security_guardium_key_lifecycle_manager	4.1.1	cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:4.1.1:::::::*
ibm	security_guardium_key_lifecycle_manager	4.2	cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:4.2:::::::*
ibm	security_guardium_key_lifecycle_manager	4.2.1	cpe:2.3:a:ibm:security_guardium_key_lifecycle_manager:4.2.1:::::::*