IBM Db2 Mirror for i setup and GUI use gson which is vulnerable to denial of service as described in the vulnerability details section. IBM has addressed the vulnerability for IBM Db2 Mirror for i.
IBM X-Force ID: 217225
DESCRIPTION: Google Gson is vulnerable to a denial of service, caused by the deserialization of untrusted data. By using the writeReplace() method, a remote attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 7.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/217225 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H)
Affected Products and Versions
|IBM Db2 Mirror for i||7.5|
|IBM Db2 Mirror for i||7.4|
IBM recommends addressing the vulnerability now.
The vulnerability can be fixed by applying a PTF to IBM i. Releases 7.5 and 7.4 of IBM Db2 Mirror for i are supported and will be fixed.
The PTF numbers containing the fix for this vulnerability are in the following table. IBM recommends installing the group PTF rather than the individual fix.
Group PTF Number
|5770-DBM PTF Number|
|IBM Db2 Mirror for i||7.5||SF99951 level 1|
|IBM Db2 Mirror for i||7.4||SF99668 level 17|
Workarounds and Mitigations
Get Notified about Future Security Bulletins
28 Jan 2022: Initial Publication
9 June 2022: Updated for Release 7.5
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
Was this topic helpful?
09 June 2022