Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM® Db2®. (Jan 2024 CPU)

Summary

There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 7.1.5.20 and earlier, 8.0.8.15 and earlier used by IBM® Db2®. These issues were disclosed as part of the IBM Java SDK updates in January 2024.

Vulnerability Details

CVEID:CVE-2024-20952
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the Security component could allow a remote attacker to cause high confidentiality impact and high integrity impact.
CVSS Base score: 7.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/279685 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)

CVEID:CVE-2023-33850
**DESCRIPTION:**IBM GSKit-Crypto could allow a remote attacker to obtain sensitive information, caused by a timing-based side channel in the RSA Decryption implementation. By sending an overly large number of trial messages for decryption, an attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 257132.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/257132 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

10.5.0.x

|

Client and Server

IBM® Db2®|

11.1.4.x

|

Client and Server

IBM® Db2®|

11.5.x

|

Client and Server

All platforms are affected.
Earlier releases (10.1, 9.7 etc.) may also be affected, but they are no longer supported.

Remediation/Fixes

The recommended solution is to apply the appropriate fix for this vulnerability.

The fix for this vulnerability is in the latest version of IBM JDK.

Affected IBM SDK, Java Technology Edition, Version:

• 7.1.5.20 and earlier
• 8.0.8.15 and earlier
• Earlier releases (7.0, 6, 5.0, 1.4.2, 1.3.1, 1.2.2 etc.) may also be affected, but they are no longer supported.

Fixes for applicable vulnerabilities are included in IBM SDK, Java Technology Edition:

• 8.0.8.20 for all Db2 releases

Customers running any vulnerable fixpack level of an affected Program, V10.5, V11.1 or V11.5, can download the latest version of IBM JDK from Fix Central.

Instructions for IBM JDK Installation can be found here:
<http://www.ibm.com/support/docview.wss?uid=swg27050993&gt;

IBM does not disclose key Db2 functionality nor replication steps for a vulnerability to avoid providing too much information to any potential malicious attacker. IBM does not want to enable a malicious attacker with sufficient knowledge to craft an exploit of the vulnerability.

Workarounds and Mitigations

None