Security Bulletin: Multiple security vulnerabilities have been identified in IBM® DB2® shipped with IBM PureData System for Operational Analytics

Summary IBM® DB2® is shipped as a component of IBM PureData System for Operational Analytics. Information about security vulnerabilities affecting IBM DB2 have been published in a security bulletin. Vulnerability Details CVEID:CVE-2017-12973 DESCRIPTION: Connect2id Nimbus JOSE+JWT could provide...

com.aliyun.hbase:alihbase-assembly (2.0.2), com.aliyun.hbase:alihbase-endpoint (2.0.2) +75 more potentially affected by CVE-2017-12972 via com.nimbusds:nimbus-jose-jwt (3.10)

com.nimbusds:nimbus-jose-jwt MAVEN version 3.10 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.aliyun.hbase:alihbase-assembly 2.0.2 - com.aliyun.hbase:alihbase-endpoint 2.0.2 -...

com.goinstant:goinstant-auth (>=1.0.3, <=1.0.5), com.nimbusds:oauth2-oidc-sdk (>=2.12, <=2.13) potentially affected by CVE-2017-12972 via com.nimbusds:nimbus-jose-jwt (2.20)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.20 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.goinstant:goinstant-auth =1.0.3, =2.12, =2.13 Source cves: CVE-2017-12972 Source advisory:...

com.nimbusds:common (>=1.73, <=1.74), com.nimbusds:oauth2-oidc-sdk (2.11) +2 more potentially affected by CVE-2017-12972 via com.nimbusds:nimbus-jose-jwt (2.19)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.19 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.nimbusds:common =1.73, =1.74 - com.nimbusds:oauth2-oidc-sdk 2.11 - com.nimbusds:oidc-userinfo-ldap...

com.nimbusds:oauth2-oidc-sdk (>=3.4, <=3.4.1), com.nimbusds:oidc-claims-source-ldap (>=1.2.7, <=1.2.9) +10 more potentially affected by CVE-2017-12972 via com.nimbusds:nimbus-jose-jwt (2.26.1)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.26.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.nimbusds:oauth2-oidc-sdk =3.4, =1.2.7, =1.2.7, =1.1.9, =1.1.9, =1.1.9, =1.1.9, =1.7.0, =4.3.1,...

org.mitre:json-web-key-generator (0.1) potentially affected by CVE-2017-12972 via com.nimbusds:nimbus-jose-jwt (3.2)

com.nimbusds:nimbus-jose-jwt MAVEN version 3.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.mitre:json-web-key-generator 0.1 Source cves: CVE-2017-12972 Source advisory: OSV:GHSA-2QP9-WG27-9PCV...

com.nimbusds:oauth2-oidc-sdk (>=2.1, <=2.8), com.nimbusds:oidc-userinfo-ldap (1.0) +1 more potentially affected by CVE-2017-12972 via com.nimbusds:nimbus-jose-jwt (2.16)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.16 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.nimbusds:oauth2-oidc-sdk =2.1, =2.8 - com.nimbusds:oidc-userinfo-ldap 1.0 -...

com.atlassian.asap:asap-client-core (>=2.11.0, <=2.14.2), com.atlassian.asap:asap-client-feign (>=2.11.0, <=2.14.2) +367 more potentially affected by CVE-2017-12972 via com.nimbusds:nimbus-jose-jwt (>=4.0, <=4.37.1)

com.nimbusds:nimbus-jose-jwt MAVEN version =4.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.14.2 and more Source cves: CVE-2017-12972 Source advisory: GHSA-2QP9-WG27-9PCV...

bio.ferlab:datalake-spark30_2.12 (0.2.39), bio.ferlab:datalake-spark31_2.12 (>=0.1.17, <=0.2.46) +96 more potentially affected by CVE-2017-12972 via com.nimbusds:nimbus-jose-jwt (3.1.2)

com.nimbusds:nimbus-jose-jwt MAVEN version 3.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - bio.ferlab:datalake-spark302.12 0.2.39 - bio.ferlab:datalake-spark312.12 =0.1.17, =0.2.47, =0.9.0.0,...

com.nimbusds:oauth2-oidc-sdk (2.0) potentially affected by CVE-2017-12972 via com.nimbusds:nimbus-jose-jwt (2.15.0)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.nimbusds:oauth2-oidc-sdk 2.0 Source cves: CVE-2017-12972 Source advisory: OSV:GHSA-2QP9-WG27-9PCV...

org.mitre:openid-connect-client (>=0.9.0, <=0.9.1), org.mitre:openid-connect-common (>=0.9.0, <=0.9.1) +2 more potentially affected by CVE-2017-12972 via com.nimbusds:nimbus-jose-jwt (2.13.0)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.mitre:openid-connect-client =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.1 Source cves: CVE-2017-12972...

com.github.kikuomax:spray-jwt-shapeless2_2.10 (>=0.0.1, <=0.0.3), com.github.kikuomax:spray-jwt-shapeless2_2.11 (>=0.0.1, <=0.0.3) +3 more potentially affected by CVE-2017-12972 via com.nimbusds:nimbus-jose-jwt (3.5)

com.nimbusds:nimbus-jose-jwt MAVEN version 3.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.github.kikuomax:spray-jwt-shapeless22.10 =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.3 -...

com.nimbusds:oauth2-oidc-sdk (2.9), com.nimbusds:oidc-userinfo-ldap (1.1) +1 more potentially affected by CVE-2017-12972 via com.nimbusds:nimbus-jose-jwt (2.18.1)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.18.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.nimbusds:oauth2-oidc-sdk 2.9 - com.nimbusds:oidc-userinfo-ldap 1.1 - com.nimbusds:oidc-userinfo-sp...

edu.uiuc.ncsa.myproxy:oa4mp-client-loader-oauth2 (>=3.0, <=3.2.1), edu.uiuc.ncsa.myproxy:oa4mp-client-oauth2 (>=3.0, <=3.2.1) +5 more potentially affected by CVE-2017-12972 via com.nimbusds:nimbus-jose-jwt (3.8)

com.nimbusds:nimbus-jose-jwt MAVEN version 3.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - edu.uiuc.ncsa.myproxy:oa4mp-client-loader-oauth2 =3.0, =3.0, =3.0, =3.0, =3.0, =3.0, =3.0, =3.2.1 Source...

com.nimbusds:oauth2-oidc-sdk (3.0.1), com.nimbusds:oidc-claims-source-ldap (1.2.3) +1 more potentially affected by CVE-2017-12972 via com.nimbusds:nimbus-jose-jwt (2.24)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.24 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.nimbusds:oauth2-oidc-sdk 3.0.1 - com.nimbusds:oidc-claims-source-ldap 1.2.3 -...

com.simplify:payments-sdk-java (>=1.0.0.rc1, <=1.10.0) potentially affected by CVE-2017-12972 via com.nimbusds:nimbus-jose-jwt (2.11.0)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.simplify:payments-sdk-java =1.0.0.rc1, =1.10.0 Source cves: CVE-2017-12972 Source advisory:...

org.mitre:openid-connect-client (>=1.0.1, <=1.0.11), org.mitre:openid-connect-common (>=1.0.1, <=1.0.11) +2 more potentially affected by CVE-2017-12972 via com.nimbusds:nimbus-jose-jwt (2.15.2)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.mitre:openid-connect-client =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.11 Source cves: CVE-2017-12972...

com.nimbusds:oauth2-oidc-sdk (2.10) potentially affected by CVE-2017-12972 via com.nimbusds:nimbus-jose-jwt (2.18.2)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.18.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.nimbusds:oauth2-oidc-sdk 2.10 Source cves: CVE-2017-12972 Source advisory: OSV:GHSA-2QP9-WG27-9PCV...

com.nimbusds:oauth2-oidc-sdk (>=3.0.2, <=3.2), com.nimbusds:oidc-claims-source-ldap (>=1.2.4, <=1.2.5) +3 more potentially affected by CVE-2017-12972 via com.nimbusds:nimbus-jose-jwt (2.25)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.25 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.nimbusds:oauth2-oidc-sdk =3.0.2, =1.2.4, =1.2.4, =1.4-release, =1.4-release, =1.5.4-release Source...

com.atlassian.asap:asap-client-core (>=2.11.0, <=2.14.2), com.atlassian.asap:asap-client-feign (>=2.11.0, <=2.14.2) +367 more potentially affected by CVE-2017-12972 via com.nimbusds:nimbus-jose-jwt (>=4.0, <=4.37.1)

com.nimbusds:nimbus-jose-jwt MAVEN version =4.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.14.2 and more Source cves: CVE-2017-12972 Source advisory: OSV:GHSA-2QP9-WG27-9PCV...