Lucene search

IBMC282F09EE42E3A11B248E8FA56783442EE8B4D3A973E788F8C6C0C391BBD82D3

HistorySep 03, 2024 - 5:49 p.m.

Security Bulletin: IBM Security Guardium is affected by a remote code execution vulnerability (CVE-2022-37434)

2024-09-0317:49:51

www.ibm.com

ibm security guardium

vulnerability

cve-2022-37434

remote code execution

update

heap-based buffer overflow

bounds checking

cvss

affected products

versions

fix

security patch

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

Low

JSON

Summary

IBM Security Guardium has addressed this vulnerability in an update.

Vulnerability Details

CVEID:CVE-2022-37434
**DESCRIPTION:**zlib is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by inflate in inflate.c. By using a large gzip header extra field, a remote attacker could overflow a buffer and execute arbitrary code on the system.
CVSS Base score: 7.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/232849 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Security Guardium	11.5
IBM Security Guardium	12.0

Remediation/Fixes

IBM encourages customers to update their systems promptly.

Product	Versions	Fix
IBM Security Guardium	11.5	https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=11.0&platform=Linux&function=fixId&fixids=SqlGuard_11.0p6509_August-Security-Patch_V11.5&includeSupersedes=0&source=fc
IBM Security Guardium	12.0	https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=12.0&platform=Linux&function=fixId&fixids=SqlGuard_12.0p6006_May-Security-Patch_V12.0&includeSupersedes=0&source=fc

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmsecurity_guardiumMatch11.5

ibmsecurity_guardiumMatch12.0

VendorProductVersionCPE
ibmsecurity_guardium11.5cpe:2.3:a:ibm:security_guardium:11.5:*:*:*:*:*:*:*
ibmsecurity_guardium12.0cpe:2.3:a:ibm:security_guardium:12.0:*:*:*:*:*:*:*