Lucene search

IBM2264D87F73A0F7EB39B6236AD7963BF9B99DECB73DE03732FDA7576C20109204

HistoryMay 18, 2023 - 7:02 a.m.

Security Bulletin: Security vulnerabilities have been identified in IBM Db2 shipped with IBM Security Guardium Key Lifecycle Manager (CVE-2023-27559, CVE-2023-26022, CVE-2023-25930, CVE-2023-26021, CVE-2023-27555, CVE-2023-29255, CVE-2023-29257)

2023-05-1807:02:14

www.ibm.com

ibm db2

security guardium

key lifecycle manager

cve-2023-27559

cve-2023-26022

cve-2023-25930

denial of service

remediation

aix

linux

windows

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.003

Percentile

71.5%

JSON

Summary

IBM Db2 is shipped as a component of IBM Security Key Lifecycle Manager (SKLM/GKLM). Information about multiple security vulnerabilities affecting IBM Db2 has been published in a security bulletin.

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Principal Product and Version(s)

| Affected Supporting Product and Version
—|—
IBM Security Key Lifecycle Manager (SKLM) v3.0 | IBM Db2 11.1.2.2
IBM Security Key Lifecycle Manager (SKLM) v3.0.1 | IBM Db2 11.1.2.2
IBM Security Key Lifecycle Manager (SKLM) v4.0 | IBM Db2 11.1.4.4
IBM Security Guardium Key Lifecycle Manager (GKLM) v4.1 | IBM Db2 11.5.4
IBM Security Guardium Key Lifecycle Manager (GKLM) v4.1.1 | IBM Db2 11.5.6
IBM Security Guardium Key Lifecycle Manager (GKLM) v4.2 | IBM Db2 11.5.8

Remediation/Fixes

IBM® Db2® is vulnerable to a denial of service as the server may crash when using a specially crafted subquery. (CVE-2023-27559)

Principal Product and Version(s)	Remediation/ Fixes
IBM Security Key Lifecycle Manager (SKLM) v3.0

AIX

Linux

Windows

IBM Security Key Lifecycle Manager (SKLM) v3.0.1
IBM Security Key Lifecycle Manager (SKLM) v4.0
IBM Security Guardium Key Lifecycle Manager (GKLM) v4.1 |

AIX

Linux

Windows

IBM Security Guardium Key Lifecycle Manager (GKLM) v4.1.1
IBM Security Guardium Key Lifecycle Manager (GKLM) v4.2 |

AIX

Linux

Windows

Please consult following security bulletins from IBM Db2 for more detail:

IBM® Db2® is vulnerable to a denial of service as the server may crash when using a specially crafted subquery. (CVE-2023-27559)

IBM® Db2® is vulnerable to a denial of service as the server may crash when an Out of Memory occurs. (CVE-2023-26022)

Principal Product and Version(s)	Remediation/ Fixes
IBM Security Key Lifecycle Manager (SKLM) v3.0

AIX

Linux

Windows

IBM Security Key Lifecycle Manager (SKLM) v3.0.1
IBM Security Key Lifecycle Manager (SKLM) v4.0
IBM Security Guardium Key Lifecycle Manager (GKLM) v4.1 |

AIX

Linux

Windows

IBM Security Guardium Key Lifecycle Manager (GKLM) v4.1.1
IBM Security Guardium Key Lifecycle Manager (GKLM) v4.2 |

AIX

Linux

Windows

Please consult following security bulletins from IBM Db2 for more detail:

IBM® Db2® is vulnerable to a denial of service as the server may crash when an Out of Memory occurs. (CVE-2023-26022)

IBM® Db2® is vulnerable to a denial of service. Under rare conditions, setting a special register may cause the Db2 server to terminate abnormally. (CVE-2023-25930)

Principal Product and Version(s)	Remediation/ Fixes
IBM Security Key Lifecycle Manager (SKLM) v3.0	Not affected
IBM Security Key Lifecycle Manager (SKLM) v3.0.1	Not affected
IBM Security Key Lifecycle Manager (SKLM) v4.0	Not affected
IBM Security Guardium Key Lifecycle Manager (GKLM) v4.1	Not affected
IBM Security Guardium Key Lifecycle Manager (GKLM) v4.1.1	Not affected
IBM Security Guardium Key Lifecycle Manager (GKLM) v4.2	Not affected

Please consult following security bulletins from IBM Db2 for more detail:

IBM® Db2® is vulnerable to a denial of service. Under rare conditions, setting a special register may cause the Db2 server to terminate abnormally. (CVE-2023-25930)

IBM® Db2® is vulnerable to a denial of service as the server may crash when compiling a specially crafted SQL query using a LIMIT clause. (CVE-2023-26021)

Principal Product and Version(s)	Remediation/ Fixes
IBM Security Key Lifecycle Manager (SKLM) v3.0

AIX

Linux

Windows

IBM Security Key Lifecycle Manager (SKLM) v3.0.1
IBM Security Key Lifecycle Manager (SKLM) v4.0
IBM Security Guardium Key Lifecycle Manager (GKLM) v4.1 |

AIX

Linux

Windows

IBM Security Guardium Key Lifecycle Manager (GKLM) v4.1.1
IBM Security Guardium Key Lifecycle Manager (GKLM) v4.2 |

AIX

Linux

Windows

Please consult following security bulletins from IBM Db2 for more detail:

IBM® Db2® is vulnerable to a denial of service as the server may crash when compiling a specially crafted SQL query using a LIMIT clause. (CVE-2023-26021)

IBM® Db2® is vulnerable to a denial of service as the server may crash when when attempting to use ACR client affinity for unfenced DRDA federation wrappers. (CVE-2023-27555)

Principal Product and Version(s)	Remediation/ Fixes
IBM Security Key Lifecycle Manager (SKLM) v3.0	Not affected
IBM Security Key Lifecycle Manager (SKLM) v3.0.1	Not affected
IBM Security Key Lifecycle Manager (SKLM) v4.0	Not affected
IBM Security Guardium Key Lifecycle Manager (GKLM) v4.1	Not affected
IBM Security Guardium Key Lifecycle Manager (GKLM) v4.1.1	Not affected
IBM Security Guardium Key Lifecycle Manager (GKLM) v4.2	Not affected

Please consult following security bulletins from IBM Db2 for more detail:

IBM® Db2® is vulnerable to a denial of service as the server may crash when when attempting to use ACR client affinity for unfenced DRDA federation wrappers. (CVE-2023-27555)

IBM® Db2® is vulnerable to a denial of service as as it may trap when compiling a variation of an anonymous

block. (CVE-2023-29255)

Principal Product and Version(s)	Remediation/ Fixes
IBM Security Key Lifecycle Manager (SKLM) v3.0

AIX

Linux

Windows

IBM Security Key Lifecycle Manager (SKLM) v3.0.1
IBM Security Key Lifecycle Manager (SKLM) v4.0
IBM Security Guardium Key Lifecycle Manager (GKLM) v4.1 |

AIX

Linux

Windows

IBM Security Guardium Key Lifecycle Manager (GKLM) v4.1.1
IBM Security Guardium Key Lifecycle Manager (GKLM) v4.2 |

AIX

Linux

Windows

Please consult following security bulletins from IBM Db2 for more detail:

IBM® Db2® is vulnerable to a denial of service as as it may trap when compiling a variation of an anonymous block. (CVE-2023-29255)

IBM® Db2® is vulnerable to remote code execution as a database administrator of one database may execute code or read/write files from another database within the same instance. (CVE-2023-29257)

Principal Product and Version(s)	Remediation/ Fixes
IBM Security Key Lifecycle Manager (SKLM) v3.0	Not affected
IBM Security Key Lifecycle Manager (SKLM) v3.0.1	Not affected
IBM Security Key Lifecycle Manager (SKLM) v4.0	Not affected
IBM Security Guardium Key Lifecycle Manager (GKLM) v4.1	Not affected
IBM Security Guardium Key Lifecycle Manager (GKLM) v4.1.1	Not affected
IBM Security Guardium Key Lifecycle Manager (GKLM) v4.2	Not affected

Please consult following security bulletins from IBM Db2 for more detail:

IBM® Db2® is vulnerable to remote code execution as a database administrator of one database may execute code or read/write files from another database within the same instance. (CVE-2023-29257)

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmsecurity_key_lifecycle_managerMatch3.0

ibmsecurity_key_lifecycle_managerMatch3.0.1

ibmsecurity_key_lifecycle_managerMatch4.0

ibmsecurity_key_lifecycle_managerMatch4.1

ibmsecurity_key_lifecycle_managerMatch4.1.1

ibmsecurity_key_lifecycle_managerMatch4.2

VendorProductVersionCPE
ibmsecurity_key_lifecycle_manager3.0cpe:2.3:a:ibm:security_key_lifecycle_manager:3.0:*:*:*:*:*:*:*
ibmsecurity_key_lifecycle_manager3.0.1cpe:2.3:a:ibm:security_key_lifecycle_manager:3.0.1:*:*:*:*:*:*:*
ibmsecurity_key_lifecycle_manager4.0cpe:2.3:a:ibm:security_key_lifecycle_manager:4.0:*:*:*:*:*:*:*
ibmsecurity_key_lifecycle_manager4.1cpe:2.3:a:ibm:security_key_lifecycle_manager:4.1:*:*:*:*:*:*:*
ibmsecurity_key_lifecycle_manager4.1.1cpe:2.3:a:ibm:security_key_lifecycle_manager:4.1.1:*:*:*:*:*:*:*
ibmsecurity_key_lifecycle_manager4.2cpe:2.3:a:ibm:security_key_lifecycle_manager:4.2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	security_key_lifecycle_manager	3.0	cpe:2.3:a:ibm:security_key_lifecycle_manager:3.0:::::::*
ibm	security_key_lifecycle_manager	3.0.1	cpe:2.3:a:ibm:security_key_lifecycle_manager:3.0.1:::::::*
ibm	security_key_lifecycle_manager	4.0	cpe:2.3:a:ibm:security_key_lifecycle_manager:4.0:::::::*
ibm	security_key_lifecycle_manager	4.1	cpe:2.3:a:ibm:security_key_lifecycle_manager:4.1:::::::*
ibm	security_key_lifecycle_manager	4.1.1	cpe:2.3:a:ibm:security_key_lifecycle_manager:4.1.1:::::::*
ibm	security_key_lifecycle_manager	4.2	cpe:2.3:a:ibm:security_key_lifecycle_manager:4.2:::::::*