Security Bulletin: Multiple vulnerabilities in IBM DB2 affect IBM Operations Analytics Predictive Insights

Summary

There are multiple vulnerabilities in IBM® DB2, which is a core component used by IBM Operations Analytics Predictive Insights 1.3.6 and earlier. IBM Operations Analytics Predictive Insights has addressed the applicable CVEs (CVE-2023-29257, CVE-2023-26021, CVE-2023-26022, CVE-2023-27559, CVE-2023-25930, CVE-2023-29255, CVE-2023-27555 )

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Remediation/Fixes

Please consult and apply the recommended fixes in the security bulletin: Security Bulletin: IBM® Db2® is vulnerable to remote code execution as a database administrator of one database may execute code or read/write files from another database within the same instance. (CVE-2023-29257)

Please consult and apply the recommended fixes in the security bulletin: Security Bulletin: IBM® Db2® is vulnerable to a denial of service as the server may crash when compiling a specially crafted SQL query using a LIMIT clause. (CVE-2023-26021)

Please consult and apply the recommended fixes in the security bulletin: Security Bulletin: IBM® Db2® is vulnerable to a denial of service as the server may crash when an Out of Memory occurs. (CVE-2023-26022)

Please consult and apply the recommended fixes in the security bulletin: Security Bulletin: IBM® Db2® is vulnerable to a denial of service as the server may crash when using a specially crafted subquery. (CVE-2023-27559)

Please consult and apply the recommended fixes in the security bulletin: Security Bulletin: IBM® Db2® is vulnerable to a denial of service. Under rare conditions, setting a special register may cause the Db2 server to terminate abnormally. (CVE-2023-25930)

Please consult and apply the recommended fixes in the security bulletin: <https://www.ibm.com/support/pages/security-bulletin-ibm®-db2®-vulnerable-denial-service-it-may-trap-when-compiling-variation-anonymous-block-cve-2023-29255&gt;

Please consult and apply the recommended fixes in the security bulletin: Security Bulletin: IBM® Db2® is vulnerable to a denial of service as the server may crash when when attempting to use ACR client affinity for unfenced DRDA federation wrappers. (CVE-2023-27555)

Workarounds and Mitigations

None