Product Updates & Security Announcements

CVEID 

Published 

Severity 

Description 

Products affected 

Remediation 

APAR list 

CVE-2022-3509 

CVE-2022-3171 

Mar 30 

Medium 

Multiple Vulnerabilities have been identified in WebSphere Application Server Liberty shipped with Cloud Pak System 

IBM Cloud Pak System Software 

Apply Interm Fix https://www.ibm.com/support/pages/node/6841847 

PH50342 

CVE-2022-43680 

10-Feb 

Critical 

Multiple vulnerabilities in the Expat library affect IBM® Db2® Net Search Extender may lead to denial of service or arbitrary code execution. These vulnerabilities have been addressed. 

IBM DB2 V9.7, 10.1, 10.5, 11.1 

Customers running any vulnerable fixpack level of an affected Program, V9.7, V10.1, V10.5, and v11.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent fixpack level for each impacted release: V9.7 FP11, V10.1 FP6, V10.5 FP11, and V11.1.4 FP7. They can be applied to any affected fixpack level of the appropriate release to remediate this vulnerability. 

CVE-2022-43930 

10-Feb 

Critical 

IBM® Db2® is vulnerable to an information disclosure vulnerability as sensitive information may be included in a log file. (CVE-2022-43930) 

Db2 for Linux, UNIX and Windows 

Customers running any vulnerable fixpack level of an affected Program,  V10.5, v11.1 and V11.5, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent fixpack level for each impacted release:  V10.5 FP11, V11.1.4 FP7, and V11.5.8. They can be applied to any affected fixpack level of the appropriate release to remediate this vulnerability. 

CVE-2022-25887 

10-Feb 

Critical 

 Node.js sanitize-html module is vulnerable to a denial of service, caused by insecure global regular expression replacement logic of HTML comment removal. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to cause a Regular Expression Denial of Service (ReDoS). 

IBM Business Automation Workflow traditional 

Apply DT178158 

DT178158 

CVE-2023-23477 

10-Feb 

Critical 

WebSphere Application Server is shipped as a component of IBM Business Automation Workflow. Information about a security vulnerability affecting IBM WebSphere Application Server Traditional have been published in a security bulletin. 

IBM Business Automation Workflow traditional 8.5 and 9.0 

Apply fixpack 9.0.5.8 or 8.5.5.20 

CVE-2022-21628 

10-Feb 

Critical 

Multiple Vulnerabilities were disclosed as part of the Oracle October 2022 Critical Patch Update. 

ICC for SAP v4.0 

Use IBM Content Collector for SAP Applications4.0.0.2-ICCSAP-FP2-JRE-8.0.7.20 
Use IBM Content Collector for SAP Applications4.0.0.3-ICCSAP-Base-JRE-8.0.7.20 
Use IBM Content Collector for SAP Applications4.0.0.4-ICCSAP-Base-JRE-8.0.7.20