Security Bulletin: IBM® Db2® LUW on AIX and Linux Affected by a Vulnerability in IBM® Spectrum Scale (CVE-2019-4558)

Summary

Db2 LUW is affected by a vulnerability in IBM® Spectrum Scale Version 5.0.x and 4.2.x that is used by Db2® pureScale™ Feature on AIX and Linux. IBM Spectrum Scale is previously known as General Parallel File System (GPFS).

Vulnerability Details

CVEID:CVE-2019-4558
**DESCRIPTION:**A security vulnerability has been identified in all levels of IBM Spectrum Scale V5.0.0.0 through V5.0.3.2 and IBM Spectrum Scale V4.2.0.0 through V4.2.3.17 that could allow a local attacker to obtain root privilege by injecting parameters into setuid files.
CVSS Base score: 8.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/166282 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

All fix pack levels of IBM Db2 V11.1 and V11.5 editions running on AIX and Linux are affected, and only for those customers who have Db2® pureScale™ Feature installed.

IBM Db2 V10.5 is not affected

Remediation/Fixes

The recommended solution is to apply the appropriate fix for this vulnerability.

FIX:

11.1

|

4.2.3.17 eFix 1

11.5

|

5.0.2.3 eFix 35

The GPFS eFix install instructions are available here:<http://www-01.ibm.com/support/docview.wss?uid=swg27048484&gt;

Workarounds and Mitigations

None