Resource exhaustion in IBM DB2 - CVE-2022-43929

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU72058

Resource exhaustion in IBM DB2 - CVE-2022-43929

Published: February 8, 2023


Vulnerability identifier: #VU72058
CSH Severity: Low
CVSS v4 BT: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-43929
CWE-ID: CWE-400
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when processing input passed to the "Load" command. A local user can trigger resource exhaustion and perform a denial of service (DoS) attack.


Affected software

IBM DB2
DB2 Warehouse on Cloud Pak for Data
DB2 on Cloud Pak for Data
Db2 Big SQL
IBM Intelligent Operations Center
IBM Security Verify Governance
IBM Sterling Partner Engagement Manager
IBM Cloud Application Performance Management (APM)
IBM Cloud Pak for Business Automation
IBM Cloud Pak System
Spectrum Protect Server

How to mitigate CVE-2022-43929

Install updates from vendor's website.

IBM Intelligent Operations Center - update to 5.2.4
IBM Cloud Pak System - update to 2.3.3.7 iFix 01
IBM Sterling Partner Engagement Manager - addressed in versions 6.1.2.8, 6.2.0.6, 6.2.1.3, 6.2.2.1
Db2 Big SQL - update to 7.5
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.4
Spectrum Protect Server - update to 8.1.18
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.22, 22.0.2.6

External References

Related Security Bulletins