Third-party bugs squashed in IBM database software

By

Apache Log4j rears its head.

IBM has patched its 'Db2 Web Query for i' software against a number of vulnerabilities inherited from other packages.

Third-party bugs squashed in IBM database software

Db2 Web Query for i uses the vulnerable Apache Log4j for generating logs and diagnostic traces, IBM’s advisory stated, and needed patching.

Another component, Apache Commons Compress, also carried a vulnerability: CVE-2021-36090, which was discovered last July and IBM describes as a denial of service bug created by an out-of-memory error when large amounts of memory are allocated.

Services using Compress’ zip package can be attacked using a crafted ZIP archive.

The other vulnerable package the database software uses is Tibco WebFOCUS, which is impacted by a cross-site scripting vulnerability, CVE-2021-35493.

An attacker can use a crafted URL to execute scripts in the victim’s browser, “within the security context of the hosting Web site, once the URL is clicked.

"An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials,” IBM said.

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © iTnews.com.au . All rights reserved.
Tags:

Most Read Articles

CBA using facial recognition logins to verify disputed payments

CBA using facial recognition logins to verify disputed payments

Top US diplomat impersonated with AI by unknown actor

Top US diplomat impersonated with AI by unknown actor

UK police arrest four over cyberattacks on M&S, Co-op and Harrods

UK police arrest four over cyberattacks on M&S, Co-op and Harrods

Google Gemini for Workspace vulnerable to prompt injection attacks

Google Gemini for Workspace vulnerable to prompt injection attacks

Log In

  |  Forgot your password?