Medium WID-SEC-2023-1116 5 CVEs

IBM DB2: Mehrere Schwachstellen ermöglichen Denial of Service

Published May 1, 2023 · Updated Sep 6, 2023 · Revision 5 · de-DE

Vendor: amazon Vendor: Fedora Vendor: IBM Product: Db2 Product: DB2 < REST 1.0.0.266-amd64 Product: DB2 < REST latest-amd64 Product: Linux Product: Linux 2 Product: Spectrum Protect plus 10.1 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM DB2 ausnutzen, um einen Denial of Service Angriff durchzuführen.

Product

IBM DB2 ist ein relationales Datenbanksystem (RDBS) von IBM.

Vulnerabilities 5

High 7.5

CVE-2022-41723

Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.

Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go

Feb 28, 2023
High 7.5

CVE-2023-24537

Infinite loop in parsing in go/scanner

Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow.

Go standard library go/scanner katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Apr 6, 2023
Unscored —

CVE-2022-41724

Panic on large handshake records in crypto/tls

Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 cli…

Go standard library crypto/tls katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Feb 28, 2023
Unscored —

CVE-2022-41725

Excessive resource consumption in mime/multipart

A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory and disk files. This also affects form parsing in th…

Go standard library mime/multipart katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Feb 28, 2023
Unscored —

CVE-2023-24532

Incorrect calculation on P256 curves in crypto/internal/nistec

The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars (a scalar larger than the order of the curve). This does not impact usages of crypto/ecdsa or crypto/ecdh.

Go standard library crypto/internal/nistec katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Mar 8, 2023

Revision history

2023-09-06 #5
Neue Updates von Amazon aufgenommen
2023-06-29 #4
Neue Updates von IBM aufgenommen
2023-06-20 #3
Neue Updates von IBM aufgenommen
2023-05-29 #2
Neue Updates von Fedora aufgenommen
2023-05-01 #1
Initiale Fassung

References

Amazon Linux Security Advisory ALAS2NITRO-ENCLAVES-2023-029 vom 2023-09-07
https://alas.aws.amazon.com/AL2/ALASNITRO-ENCLAVES-2023-029.html
Amazon Linux Security Advisory ALAS2DOCKER-2023-030 vom 2023-09-07
https://alas.aws.amazon.com/AL2/ALASDOCKER-2023-030.html
IBM Security Bulletin 7008449 vom 2023-06-29
https://www.ibm.com/support/pages/node/7008449
IBM Security Bulletin 7005589 vom 2023-06-21
https://www.ibm.com/support/pages/node/7005589
Fedora Security Advisory FEDORA-EPEL-2023-EFD9BBF67E vom 2023-05-26
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-efd9bbf67e
IBM Security Bulletin: 6987489 vom 2023-05-01
https://www.ibm.com/support/pages/node/6987489