Skip to content
OpenAdvisories
Medium WID-SEC-2022-2339 11 CVEs

IBM DB2: Mehrere Schwachstellen

Published Dec 14, 2022 · Updated Apr 18, 2023 · Revision 2 · de-DE

Vendor: IBM Product: Db2 Product: DB2 Cloud Pak for Data < 4.6 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in IBM DB2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data ausnutzen, um die Vertraulichkeit, Verfügbarkeit und Integrität zu gefährden.

Product

IBM DB2 ist ein relationales Datenbanksystem (RDBS) von IBM.

Vulnerabilities 11

  • High 7.5
    CVE-2022-27664

    golang.org/x/net/http2 Denial of Service vulnerability

    In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

    katib-suggestion-hyperopt katib-earlystopping katib-suggestion-skopt-enas katib-suggestion-hyperband Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.5
    CVE-2022-30633

    Stack exhaustion when unmarshaling certain documents in encoding/xml

    Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag.

    Go standard library encoding/xml golang go Debian Ubuntu Azure Linux Alpine Go
  • Medium 6.8
    CVE-2021-32690

    Repository credentials passed to alternate domain

    Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources). In versions of helm prior to 3.6.1, a vulnerability exists where the username and password credentials associated with a Helm repository could be passed on to another domain…

    helm helm helm.sh/helm/v3 helm Azure Linux Alpine Go
  • Medium 6.5
    CVE-2022-36055

    Denial of service in Helm

    Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. Fuzz testing, provided by the CNCF, identified input to functions in the _strvals_ package that can cause an out of memory panic. The _strvals_ package contains a …

    helm helm helm.sh/helm/v3 helm Azure Linux Go
  • Medium 6.5
    CVE-2022-41296

    IBM Db2U cross-site respect forgery

    IBM Db2U 3.5, 4.0, and 4.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 237210.

    IBM Db2U
  • Medium 5.9
    CVE-2021-21303

    Injection attack in Helm

    Helm is open-source software which is essentially "The Kubernetes Package Manager". Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. In Helm from version 3.0 and before version 3.5.2, there a few cases where data…

    helm helm helm.sh/helm/v3 helm Ubuntu Azure Linux Alpine Go
  • Medium 5.3
    CVE-2022-29526

    golang.org/x/sys/unix has Incorrect privilege reporting in syscall

    Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.

    golang stdlib k3d golang-1.8 Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 5.1
    CVE-2022-3172 Public exploit

    Kubernetes - API server - Aggregated API server can cause clients to be redirected (SSRF)

    A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This could lead to the client performing unexpected actions as well as forwarding the client's API server credentials to third partie…

    Kubernetes kube-apiserver kubernetes Debian
  • Medium 4.3
    CVE-2022-41297

    IBM Db2U cross-site request forgery

    IBM Db2U 3.5, 4.0, and 4.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 237212.

    IBM Db2U
  • Unscored —
    CVE-2016-1000023 Rejected

    DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10540. Reason: This candidate is a reservation duplicate of CVE-…

  • Unscored —
    CVE-2022-28131

    Stack exhaustion from deeply nested XML documents in encoding/xml

    Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.

    Go standard library encoding/xml golang go Debian Ubuntu Azure Linux Alpine Go

Revision history

  1. #2

    Neue Updates von IBM aufgenommen

  2. #1

    Initiale Fassung

References