Security Bulletin: Multiple security vulnerabilities have been identified in IBM Db2 shipped with IBM Security Guardium Key Lifecycle Manager

Summary

IBM Db2 is shipped as a component of IBM Security Key Lifecycle Manager (SKLM/GKLM). Information about multiple security vulnerabilities affecting IBM Db2 has been published in a security bulletin.

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Principal Product and Version(s)

| Affected Supporting Product and Version
—|—
IBM Security Key Lifecycle Manager (SKLM) v3.0| IBM Db2 11.1.2.2
IBM Security Key Lifecycle Manager (SKLM) v3.0.1| IBM Db2 11.1.2.2
IBM Security Key Lifecycle Manager (SKLM) v4.0| IBM Db2 11.1.4.4
IBM Security Guardium Key Lifecycle Manager (GKLM) v4.1| IBM Db2 11.5.4
IBM Security Guardium Key Lifecycle Manager (GKLM) v4.1.1| IBM Db2 11.5.8
IBM Security Guardium Key Lifecycle Manager (GKLM) v4.2| IBM Db2 11.5.8

Remediation/Fixes

1. IBM® Db2® is vulnerable to privilege escalation with DATAACCESS. (CVE-2023-38003)

Please consult following security bulletins from IBM Db2 for more detail:

IBM® Db2® is vulnerable to privilege escalation with DATAACCESS. (CVE-2023-38003)

2. IBM® Db2® is vulnerable to denial of service with a specially crafted SQL statement. (CVE-2023-38727)

Please consult following security bulletins from IBM Db2 for more detail:

IBM® Db2® is vulnerable to denial of service with a specially crafted SQL statement. (CVE-2023-38727)

3. IBM® Db2® is vulnerable to denial of service with a specially crafted RUNSTATS command. (CVE-2023-40687)

Please consult following security bulletins from IBM Db2 for more detail:

IBM® Db2® is vulnerable to denial of service with a specially crafted RUNSTATS command. (CVE-2023-40687)

4. IBM® Db2® is vulnerable to denial of service under extreme stress conditions. (CVE-2023-40692)

Please consult following security bulletins from IBM Db2 for more detail:

IBM® Db2® is vulnerable to denial of service under extreme stress conditions. (CVE-2023-40692)

5. IBM® Db2® is affected by multiple vulnerabilities in the open source zlib library.

Please consult following security bulletins from IBM Db2 for more detail:

IBM® Db2® is affected by multiple vulnerabilities in the open source zlib library.

6. IBM® Db2® is vulnerable to denial of service with a specially crafted query. (CVE-2023-43020)

Please consult following security bulletins from IBM Db2 for more detail:

IBM® Db2® is vulnerable to denial of service with a specially crafted query. (CVE-2023-43020)

7. Multiple vulnerabilities in open source libraries affect IBM® Db2® Federated.

Please consult following security bulletins from IBM Db2 for more detail:

Multiple vulnerabilities in open source libraries affect IBM® Db2® Federated.

8. IBM® Db2® could allow an authenticated user with CONNECT privileges to cause a denial of service using a

specially crafted query. (CVE-2023-47701)

Please consult following security bulletins from IBM Db2 for more detail:

IBM® Db2® could allow an authenticated user with CONNECT privileges to cause a denial of service using a

specially crafted query. (CVE-2023-47701)

9. IBM® Db2® federated server is vulnerable to a denial of service when a specially crafted cursor is

used. (CVE-2023-46167)

Please consult following security bulletins from IBM Db2 for more detail:

IBM® Db2® federated server is vulnerable to a denial of service when a specially crafted cursor is

used. (CVE-2023-46167)

10. IBM® Db2® is vulnerable to a denial of service when a specially crafted request is used via CLI. (CVE-2023-45178)

Please consult following security bulletins from IBM Db2 for more detail:

IBM® Db2® is vulnerable to a denial of service when a specially crafted request is used via CLI. (CVE-2023-45178)

11. IBM® Db2® is vulnerable to a denial of service through a specially crafted federated query on specific federation objects. (CVE-2023-29258)

Please consult following security bulletins from IBM Db2 for more detail:

IBM® Db2® is vulnerable to a denial of service through a specially crafted federated query on specific federation

objects. (CVE-2023-29258)

12. IBM® Db2® is affected by multiple vulnerabilities in the consumed PCRE library.

Please consult following security bulletins from IBM Db2 for more detail:

IBM® Db2® is affected by multiple vulnerabilities in the consumed PCRE library.

Recommendation:

As all these security issues have been fixed in IBM Db2 11.5.9,

i) For SKLMv3.0 and 3.0.1, it is recommended to upgrade to GKLMv4.2(which comes with Db2 11.5.8) and then upgrade Db2 to version

11.5.9.

ii)For SKLMv4.0, SKLMv4.1, GKLMv4.1.1, GKLMv4.2, it is recommended to upgrade GKLM to version GKLMv4.2.1 (which comes

with Db2 11.5.9).

For more information, checkout support matrix - Support Matrix

Workarounds and Mitigations

None