CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
Percentile
44.6%
IBM® DB2® is shipped as a component of IBM PureData System for Operational Analytics. Information about security vulnerabilities affecting IBM DB2 have been published in a security bulletin (CVE-2022-43927,CVE-2022-43929).
CVEID:CVE-2022-43929
**DESCRIPTION:**IBM Db2 for Linux, UNIX and Windows 11.1 and 11.5 may be vulnerable to a Denial of Service when executing a specially crafted ‘Load’ command. IBM X-Force ID: 241676.
CVSS Base score: 4.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/241676 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVEID:CVE-2022-43927
**DESCRIPTION:**IBM Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 is vulnerable to information Disclosure due to improper privilege management when a specially crafted table access is used. IBM X-Force ID: 241671.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/241671 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
IBM PureData System for Operational Analytics V1.1 (A1801)
Determine the appliance fixpack level as root on the management server using the appl_ls_cat command.
$ appl_ls_cat -i
NAME VERSION STATUS DESCRIPTION
bwr3 4.0.8.0 Committed Updates for IBM_PureData_System_for_Operational_Analytics
Determine the version of Db2 used on the core nodes in the appliance. The command below shows that Version 10.5.0.11 is installed. The number of hosts, Db2 version and instance name are customer dependent. The appliance supports Db2 10.5 or Db2 11.1 and the default instance owner is bcuaix. The command below shows that the instance is used Db2 10.5.0.11.
$ dsh -n ${BCUALL} ‘/usr/local/bin/db2ls -c | grep -v “#” | cut -d: -f 1 | head -1 | while read p;do $p/bin/db2greg -dump | grep “^I”;done’| dshbak -c
HOSTS -------------------------------------------------------------------------
host02, host04, host05, hostflash06
-------------------------------------------------------------------------------
I,DB2,10.5.0.11,bcuaix,/db2home/bcuaix/sqllib,1,0,/usr/IBM/dwe/db2/V10.5.0.11…2,
Login as the instance owner to any of the host servers. The following command will show the build number installed.
$ db2level
DB21085I This instance or install (instance name, where applicable: “bcuaix”)
uses “64” bits and DB2 code release “SQL1005B” with level identifier
“060C010E”.
Informational tokens are “DB2 v10.5.0.11”, “special_40479”, “IP24071_40479”,
and Fix Pack “11”.
Product is installed at “/usr/IBM/dwe/db2/V10.5.0.11…2”.
Use the table below to determine how to download the Db2 Fixpack or Special Build and then refer to the appliance technote <https://www.ibm.com/support/pages/installing-db2-fix-pack-ibm-puredata-system-operational-analytics> for instructions on how to apply the Db2 Fixpack or Special Build on the appliance. Contact IBM Support for any questions or concerns related to this update. The number in brackets will match version returned by the appl_ls_conf command.
Current V1.1 Fixpack Level | Remediation Options |
---|---|
V1.1 GA [ 4.0.4.x ] |
Special Build 41247 for DB2 10.5 Fix Pack 11 for AIX (64 bit), DB2 Universal Fix Pack
Special Build 41246 for DB2 11.1.4 Fix Pack 7 for AIX (64 bit), DB2 Universal Fix Pack
V1.1 FP1 [ 4.0.5.x ]|
Special Build 41247 for DB2 10.5 Fix Pack 11 for AIX (64 bit), DB2 Universal Fix Pack
Special Build 41246 for DB2 11.1.4 Fix Pack 7 for AIX (64 bit), DB2 Universal Fix Pack
V1.1 FP2 [ 4.0.6.x ]|
Special Build 41247 for DB2 10.5 Fix Pack 11 for AIX (64 bit), DB2 Universal Fix Pack
Special Build 41246 for DB2 11.1.4 Fix Pack 7 for AIX (64 bit), DB2 Universal Fix Pack
V1.1 FP3 [ 4.0.7.x ]|
Special Build 41247 for DB2 10.5 Fix Pack 11 for AIX (64 bit), DB2 Universal Fix Pack
Special Build 41246 for DB2 11.1.4 Fix Pack 7 for AIX (64 bit), DB2 Universal Fix Pack
V1.1 FP4 [ 4.0.8.x ]|
Special Build 41247 for DB2 10.5 Fix Pack 11 for AIX (64 bit), DB2 Universal Fix Pack
Special Build 41246 for DB2 11.1.4 Fix Pack 7 for AIX (64 bit), DB2 Universal Fix Pack
V1.1 FP5 [ 4.0.9.x ]|
Special Build 41247 for DB2 10.5 Fix Pack 11 for AIX (64 bit), DB2 Universal Fix Pack
Special Build 41246 for DB2 11.1.4 Fix Pack 7 for AIX (64 bit), DB2 Universal Fix Pack
None
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
Percentile
44.6%