www.ibm.com
Open in
urlscan Pro
2600:141b:7000:682::1e89
Public Scan
URL:
https://www.ibm.com/support/pages/node/6583541
Submission: On August 10 via api from CA — Scanned from CA
Submission: On August 10 via api from CA — Scanned from CA
Form analysis
3 forms found in the DOMPOST /support/pages/node/6583541
<form action="/support/pages/node/6583541" method="post" id="openid-connect-login-form" accept-charset="UTF-8">
<div><input data-drupal-selector="edit-openid-connect-client-generic-login" type="submit" id="edit-openid-connect-client-generic-login" name="generic" value="Log in with Generic" class="button js-form-submit form-submit">
</div><input autocomplete="off" data-drupal-selector="form-kjm9wo8yi7owj6-iebgkyg-wwa1srv1xs9vlzbtaeiq" type="hidden" name="form_build_id" value="form-kJm9wo8Yi7OWj6_iEbGKyg_WWA1srV1Xs9vLzbtAEiQ">
<input data-drupal-selector="edit-openid-connect-login-form" type="hidden" name="form_id" value="openid_connect_login_form">
</form>
<form class="ibm-row-form ibm-home-search ibm" enctype="multipart/form-data" id="spng-search" ng-submit="omniType()">
<input id="spng-search-query" class="bx--search-input" name="text" size="40" type="search" autocomplete="off" placeholder="Search support or find a product">
<a title="Search" aria-label="Search" href="#" tabindex="-1" id="spng-search-button" ng-click="omniButton()" class="ibm-search-link common-search-link"></a>
<div id="spng-search-typeahead-wrapper" style="display:none" class="search-results-wrapper">
<div id="spng-search-typeahead" class="common-search-results">
<div id="spng-spinner" style="display:none">
<h2 class="ibm-h2 ibm-h4 ibm-bold"><span class="ibm-spinner"> </span></h2>
</div>
<div id="sp-no-results" style="display:none">
<div class="results">
<p>No results were found for your search query.</p>
<div class="ibm-rule">
<hr>
</div>
<h5 class="ibm-h5"><strong>Tips</strong></h5>
<p>To return expected results, you can:</p>
<ul>
<li><strong>Reduce the number of search terms.</strong> Each term you use focuses the search further.</li>
<li><strong>Check your spelling.</strong> A single misspelled or incorrectly typed term can change your result.</li>
<li><strong>Try substituting synonyms for your original terms.</strong> For example, instead of searching for "java classes", try "java training"</li>
<li><strong>Did you search for an IBM acquired or sold product ?</strong> If so, follow the appropriate link below to find the content you need.</li>
</ul>
</div>
</div>
<div id="sp-doc-failure" style="display:none">
<div class="category">Our apologies</div>
<div class="results">
<p>Search results are not available at this time. Please try again later or use one of the other support options on this page.</p>
</div>
</div>
<div id="sp-prev-products" class="result_section"></div>
<div id="sp-wd-results" class="result_section"></div>
<div id="sp-prod-results" class="result_section"></div>
<div id="sp-doc-results" class="result_section"></div>
</div>
</div>
</form>
POST /support/pages/node/6583541
<form class="node-security-bulletin-6583541-vote-field-was-this-topic-helpful__vote-vote-votingapi-useful-form vote-form" id="vote-form"
data-drupal-selector="node-security-bulletin-6583541-vote-field-was-this-topic-helpful-vote-vote-votingapi-useful-form" action="/support/pages/node/6583541" method="post" accept-charset="UTF-8">
<div class="js-form-item form-item js-form-type-select form-type-select js-form-item-value form-item-value form-no-label">
<select autocomplete="off" data-result-value="-1" data-vote-value="-1" data-style="default" data-show-own-vote="false" data-drupal-selector="edit-value" id="edit-value" name="value" class="form-select select2-widget ibm-widget-processed"
data-jquery-once-autocomplete="true" data-select2-autocomplete-list-widget="true" search-pagesize="10" style="display: none; width: 124px;" tabindex="0" aria-hidden="false">
<option value="-1">Not useful</option>
<option value="1">Useful</option>
</select>
<div class="useful-rating" role="complementary" aria-label="Was this topic helpful?">
<div class="like">
<a href="#"><button aria-label="Yes" tabindex="0" class="ibm-margin-right-1 bx--btn bx--btn--sm bx--btn--tertiary" type="button"><svg focusable="false" preserveAspectRatio="xMidYMid meet" xmlns="http://www.w3.org/2000/svg" fill="currentColor" aria-hidden="true" width="16" height="16" viewBox="0 0 32 32" class="bx--btn__icon"><path d="M26,12H20V6a3.0033,3.0033,0,0,0-3-3H14.8672a2.0094,2.0094,0,0,0-1.98,1.7173l-.8453,5.9165L8.4648,16H2V30H23a7.0078,7.0078,0,0,0,7-7V16A4.0045,4.0045,0,0,0,26,12ZM8,28H4V18H8Zm20-5a5.0057,5.0057,0,0,1-5,5H10V17.3027l3.9578-5.9365L14.8672,5H17a1.0008,1.0008,0,0,1,1,1v8h8a2.0025,2.0025,0,0,1,2,2Z"></path></svg><span class="text-yes">Yes</span><span id="like" style="display:none;">999</span></button></a>
</div>
<div class="dislike">
<a href="#"><button aria-label="No" tabindex="0" class="bx--btn bx--btn--sm bx--btn--tertiary" type="button"><svg focusable="false" preserveAspectRatio="xMidYMid meet" xmlns="http://www.w3.org/2000/svg" fill="currentColor" aria-hidden="true" width="16" height="16" viewBox="0 0 32 32" class="bx--btn__icon"><path d="M30,16V9a7.0078,7.0078,0,0,0-7-7H2V16H8.4648l3.5774,5.3662.8453,5.9165A2.0094,2.0094,0,0,0,14.8672,29H17a3.0033,3.0033,0,0,0,3-3V20h6A4.0045,4.0045,0,0,0,30,16ZM8,14H4V4H8Zm20,2a2.0025,2.0025,0,0,1-2,2H18v8a1.0008,1.0008,0,0,1-1,1H14.8672l-.9094-6.3662L10,14.6973V4H23a5.0057,5.0057,0,0,1,5,5Z"></path></svg><span class="text-no">No</span><span id="dislike" style="display:none;">No</span></button></a>
</div>
</div>
</div>
<input autocomplete="off" data-drupal-selector="form-zf-8vzsgk24avgjmsqn-zrhpdm1ihu56skdtu8tqw1m" type="hidden" name="form_build_id" value="form-zF_8vzsgK24AvgjMSqn_zrhpdm1IHu56SKdTu8TQw1M">
<input data-drupal-selector="edit-node-security-bulletin-6583541-vote-field-was-this-topic-helpful-vote-vote-votingapi-useful-form" type="hidden" name="form_id"
value="node_security_bulletin_6583541_vote_field_was_this_topic_helpful__vote_vote_votingapi_useful_form">
<input data-drupal-selector="edit-submit" type="submit" id="edit-submit--2" name="op" value="Save" class="button button--primary js-form-submit form-submit" data-once="drupal-ajax" style="display: none;">
</form>
Text Content
Support My IBM Log in IBM Support No results were found for your search query. -------------------------------------------------------------------------------- TIPS To return expected results, you can: * Reduce the number of search terms. Each term you use focuses the search further. * Check your spelling. A single misspelled or incorrectly typed term can change your result. * Try substituting synonyms for your original terms. For example, instead of searching for "java classes", try "java training" * Did you search for an IBM acquired or sold product ? If so, follow the appropriate link below to find the content you need. Our apologies Search results are not available at this time. Please try again later or use one of the other support options on this page. SECURITY BULLETIN: MULTIPLE VULNERABILITIES FOUND IN DB2® AFFECT IBM CLOUD PAK SYSTEM SOFTWARE AND CLOUD PAK SYSTEM SOFTWARE SUITE SECURITY BULLETIN SUMMARY IBM Db2® is shipped with IBM Cloud Pak System Software and Cloud Pak System Software Suite. IBM Db2 is a component of Platform System Manager, and Db2 pattern type (pType). Multiple vulnerabilities have been found in Db2® that affect Cloud Pak System Software and Cloud Pak System Software Suite. IBM Cloud Pak System has released a fix in response to vulnerabilities in Db2 with Cloud Pak System v2.3.3.4 update to Db2 v11.5.7 and add support to Db2 Advanced Edition. VULNERABILITY DETAILS CVEID: CVE-2020-4976 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to read and write specific files due to weak file permissions. IBM X-Force ID: 192469. CVSS Base score: 5.1 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/192469 for the current score. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) CVEID: CVE-2021-29752 DESCRIPTION: IBM Db2 11.2 and 11.5 contains an information disclosure vulnerability, exposing remote storage credentials to privileged users under specific conditions. IBM X-Fporce ID: 201780. CVSS Base score: 4.4 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/201780 for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) CVEID: CVE-2021-29763 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 under very specific conditions, could allow a local user to keep running a procedure that could cause the system to run out of memory.and cause a denial of service. IBM X-Force ID: 202267. CVSS Base score: 5.1 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/202267 for the current score. CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) CVEID: CVE-2021-29825 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could disclose sensitive information when using ADMIN_CMD with LOAD or BACKUP. IBM X-Force ID: 204470. CVSS Base score: 5.9 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/204470 for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) CVEID: CVE-2020-5024 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow an unauthenticated attacker to cause a denial of service due a hang in the SSL handshake response. IBM X-Force ID: 193660. CVSS Base score: 7.5 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/193660 for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) CVEID: CVE-2020-5025 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 db2fm is vulnerable to a buffer overflow, caused by improper bounds checking which could allow a local attacker to execute arbitrary code on the system with root privileges. IBM X-Force ID: 193661. CVSS Base score: 8.4 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/193661 for the current score. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) CVEID: CVE-2021-29777 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5, under specific circumstance of a table being dropped while being accessed in another session, could allow an authenticated user to cause a denial of srevice IBM X-Force ID: 203031. CVSS Base score: 5.3 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/203031 for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) CVEID: CVE-2021-20579 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a user who can create a view or inline SQL function to obtain sensitive information when AUTO_REVAL is set to DEFFERED_FORCE. IBM X-Force ID: 199283. CVSS Base score: 5.9 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/199283 for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) CVEID: CVE-2021-29703 DESCRIPTION: Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server terminates abnormally when executing a specially crafted SELECT statement. IBM X-Force ID: 200659. CVSS Base score: 7.5 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/200659 for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) CVEID: CVE-2020-4885 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow a local user to access and change the configuration of Db2 due to a race condition of a symbolic link,. IBM X-Force ID: 190909. CVSS Base score: 6.2 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/190909 for the current score. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) CVEID: CVE-2020-4945 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow an authenticated user to overwrite arbirary files due to improper group permissions. IBM X-Force ID: 191945. CVSS Base score: 6.5 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/191945 for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) AFFECTED PRODUCTS AND VERSIONS Main Product(s) Version(s) Affected Supporting Product version(s) IBM Cloud Pak System Software, IBM Cloud Pak System Software Suite V2.3.2.0, V2.3.3.0, V2.3.3.1, V2.3.3.2, V2.3.3.3 IBM Db2 LUW V11.5 IBM Cloud Pak System Software, IBM Cloud Pak System Software Suite V2.3.0.1, V2.3.1.1 IBM Db2 LUW V11.1 - Notice Db2 Linux, Unix, and Windows, and Db2 Connect v11.1 is end of support by April 30, 2022 as per IBM Withdrawal Announcement 920-049. REMEDIATION/FIXES For all minor release version that are end of support and unsupported releases the recommendation is to upgrade to latest fixed release. Multiple vulnerabilities have been identified in DB2 which is shipped with Cloud Pak System components. IBM Cloud Pak System has released a fix with IBM Cloud Pak System Software v2.3.3.4 update DB2 Platform System Manager and pType 1.2.17 update to DB2 v11.5.7. Additionally IBM Cloud Pak System v2.3.3.4 ships with support for DB2 Advanced Edition. Consult the following security bulletins for IBM Db2 for vulnerability details and information about fixes. Security : IBM® Db2® is vulnerable to a denial of service (CVE-2020-5024) https://www.ibm.com/support/pages/node/6427861 Security : IBM® Db2® db2fm is vulnerable to a buffer overflow (CVE-2020-5025) https://www.ibm.com/support/pages/node/6427855 Security : Under special circumstances, Db2 is vulnerable to a denial of service during drop table (CVE-2021-29777) https://www.ibm.com/support/pages/node/6466373 Security: IBM® Db2® is vulnerable to an information disclosure (CVE-2021-20579) https://www.ibm.com/support/pages/node/6466369 Security : IBM® Db2® is vulnerable to a denial of service as the server terminates abnormally when executing a specially crafted SELECT statement. (CVE-2021-29703) https://www.ibm.com/support/pages/node/6466371 Security: Multiple vulnerabilities in dependent libraries affect IBM® Db2® leading to denial of service or privilege escalation. https://www.ibm.com/support/pages/node/6466365 Security : IBM® Db2® could allow a local user to access and change the configuration of DB2 due to a race condition via a symbolic link. (CVE-2020-4885) https://www.ibm.com/support/pages/node/6466363 Security: IBM® Db2® could allow an authenticated user to overwrite arbirary files due to improper group permissions. (CVE-2020-4945) https://www.ibm.com/support/pages/node/6466367 Security: IBM® Db2® could allow a local user to read and write specific files due to weak file permissions (CVE-2020-4976) https://www.ibm.com/support/pages/node/6489495 Security: IBM® Db2® is vulnerable to an information disclosure, exposing remote storage credentials to privileged users under specific conditions.(CVE-2021-29752) https://www.ibm.com/support/pages/node/6489489 Security: IBM® Db2® under very specific conditions, could allow a local user to keep running a procedure that could cause the system to run out of memory and cause a denial of service. (CVE-2021-29763) https://www.ibm.com/support/pages/node/6489493 Security: IBM® Db2® could disclose sensitive information when using ADMIN_CMD with LOAD or BACKUP. (CVE-2021-29825) https://www.ibm.com/support/pages/node/6489499 Multiple vulnerabilities have been identified in DB2 which is shipped with Cloud Pak System components. IBM Cloud Pak System has released a fix with IBM Cloud Pak System Software v2.3.3.4 update DB2 Platform System Manager and pType 1.2.17 update to DB2 v11.5.7.IBM Cloud Pak System v2.3.3.4 ships with support for DB2 Advanced Edition. The fix requires minimum fix pack level Cloud Pak System v.2.3.3.0 and Db2 v.11.5.0.0. For Cloud Pak System V2.3.0.1, V2.3.1.1, V2.3.2.0 Upgrade to minimal fix pack levels as required by the fix and then apply the fix. For Cloud Pak System V.2.3.3.0, V.2.3.3.1, V.2.3.3.2, V2.3.3.3, V2.3.3.3 interim Fix1, * Upgrade to IBM Cloud Pak System V.2.3.3.4 Platform System Manager update to DB2 v11.5.7. Information on upgrading here:http://www.ibm.com/support/docview.wss?uid=ibm10887959. WORKAROUNDS AND MITIGATIONS None GET NOTIFIED ABOUT FUTURE SECURITY BULLETINS Subscribe to My Notifications to be notified of important product support alerts like this. REFERENCES Complete CVSS v3 Guide On-line Calculator v3 Off RELATED INFORMATION IBM Secure Engineering Web Portal IBM Product Security Incident Response Blog CHANGE HISTORY 05 May 2022: Initial Publication *The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin. DISCLAIMER According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY. In addition to other efforts to address potential vulnerabilities, IBM periodically updates the record of components contained in our product offerings. As part of that effort, if IBM identifies previously unidentified packages in a product/service inventory, we address relevant vulnerabilities regardless of CVE date. Inclusion of an older CVEID does not demonstrate that the referenced product has been used by IBM since that date, nor that IBM was aware of a vulnerability as of that date. We are making clients aware of relevant vulnerabilities as we become aware of them. "Affected Products and Versions" referenced in IBM Security Bulletins are intended to be only products and versions that are supported by IBM and have not passed their end-of-support or warranty date. Thus, failure to reference unsupported or extended-support products and versions in this Security Bulletin does not constitute a determination by IBM that they are unaffected by the vulnerability. Reference to one or more unsupported versions in this Security Bulletin shall not create an obligation for IBM to provide fixes for any unsupported or extended-support products or versions. DOCUMENT LOCATION Worldwide [{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSFQSV","label":"IBM Cloud Pak System Software"},"Component":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"2.3","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}}] WAS THIS TOPIC HELPFUL? Not usefulUseful Yes999 NoNo DOCUMENT INFORMATION More support for: IBM Cloud Pak System Software Software version: 2.3 Operating system(s): Linux Document number: 6583541 Modified date: 06 May 2022 UID ibm16583541 Page Feedback Close SHARE YOUR FEEDBACK NEED SUPPORT? * Submit feedback to IBM Support * 1-800-IBM-7378 (USA) * Directory of worldwide contacts Top products & platforms Industries Artificial intelligence Blockchain Business operations Cloud computing Data & Analytics Hybrid cloud IT infrastructure Security Supply chain What is Hybrid Cloud? What is Artificial intelligence? What is Cloud Computing? What is Kubernetes? What are Containers? What is DevOps? What is Machine Learning? IBM Consulting Communities Developer education Support - Download fixes, updates & drivers IBM Research Partner with us - PartnerWorld Training - Courses Upcoming events & webinars Annual report Career opportunities Corporate social responsibility Diversity & inclusion Industry analyst reports Investor relations News & announcements Thought leadership Security, privacy & trust About IBM LinkedIn Twitter Instagram Subscription Center Contact IBM Privacy Terms of use Accessibility United States — English Share your feedback IBM web domains ibm.com, ibm.dev, ibm.org, ibm-zcouncil.com, insights-on-business.com, jazz.net, merge.com, micromedex.com, mobilebusinessinsights.com, promontory.com, proveit.com, ptech.org, resource.com, s81c.com, securityintelligence.com, skillsbuild.org, softlayer.com, storagecommunity.org, strongloop.com, teacheradvisor.org, think-exchange.com, thoughtsoncloud.com, trusteer.com, truven.com, truvenhealth.com, alphaevents.webcasts.com, betaevents.webcasts.com, ibm-cloud.github.io, ibmbigdatahub.com, bluemix.net, mybluemix.net, ibm.net, ibmcloud.com, redhat.com, galasa.dev, blueworkslive.com, swiss-quantum.ch, altoromutual.com, blueworkslive.cn, blueworkslive.com, cloudant.com, ibm.ie, ibm.fr, ibm.com.br, ibm.co, ibm.ca, silverpop.com, community.watsonanalytics.com, eclinicalos.com, datapower.com, ibmmarketingcloud.com, thinkblogdach.com, truqua.com, my-invenio.com, skills.yourlearning.ibm.com, bluewolf.com, asperasoft.com, instana.com, taos.com, envizi.com About cookies on this site Our websites require some cookies to function properly (required). In addition, other cookies may be used with your consent to analyze site usage, improve the user experience and for advertising. For more information, please review your Cookie preferences options and IBM’s privacy statement. To provide a smooth navigation, your cookie preferences will be shared across the IBM web domains listed here. Accept all Required only