Security Bulletin: Multiple security vulnerabilities have been identified in IBM Db2 shipped with IBM Security Guardium Key Lifecycle Manager

Summary

IBM Db2 is shipped as a component of IBM Security Key Lifecycle Manager (SKLM/GKLM). Information about multiple security vulnerabilities affecting IBM Db2 has been published in security bulletins mentioned below.

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Remediation/Fixes

IBM encourages customers to update their systems promptly.

IBM® Db2® is vulnerable to denial of service via a specially crafted query on certain databases. (CVE-2023-30987)

Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM® Db2®. (Apr 2023 CPU)

IBM® Db2® is vulnerable to a denial of service with a specially crafted SQL statement (CVE-2023-38740)

IBM® Db2® is vulnerable to denial of service with a specially crafted query (CVE-2023-30991)

IBM® Db2® is vulnerable to denial of service with a specially crafted ALTER TABLE statement (CVE-2023-38720)

IBM® Db2® is vulnerable to an information disclosure vulnerability due to the consumed GSKit library (CVE-2023-33850)

IBM® Db2® is vulnerable to denial of service with a specially crafted query statement. (CVE-2023-40374)

IBM® Db2® is vulnerable to denial of service with a specially crafted XML query statement (CVE-2023-38728)

More information can be found here: https://www.ibm.com/support/pages/node/28146

Workarounds and Mitigations

None