IBM DB2: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• Medium 6.3
  CVE-2022-41716

  Unsanitized NUL in environment variables on Windows in syscall and os/exec

  Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment …

  Go standard library os/exec syscall katib-suggestion-hyperopt Debian Ubuntu Azure Linux Wolfi Go
  Nov 2, 2022
• Medium 5.3
  CVE-2022-41717 Public exploit

  Excessive memory growth in net/http and golang.org/x/net/http2

  An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large…

  Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  Dec 8, 2022

Revision history

1. 2023-06-29 #3

   Neue Updates von IBM aufgenommen

2. 2023-06-20 #2

   Neue Updates von IBM aufgenommen

3. 2023-04-17 #1

   Initiale Fassung

References

• IBM Security Bulletin 7008449 vom 2023-06-29
  https://www.ibm.com/support/pages/node/7008449
• IBM Security Bulletin 7005589 vom 2023-06-21
  https://www.ibm.com/support/pages/node/7005589
• IBM Security Bulletin: 6984199 vom 2023-04-17
  https://www.ibm.com/support/pages/node/6984199