Third-party bugs squashed in IBM database software

IBM has patched its 'Db2 Web Query for i' software against a number of vulnerabilities inherited from other packages.

Db2 Web Query for i uses the vulnerable Apache Log4j for generating logs and diagnostic traces, IBM’s advisory stated, and needed patching.

Another component, Apache Commons Compress, also carried a vulnerability: CVE-2021-36090, which was discovered last July and IBM describes as a denial of service bug created by an out-of-memory error when large amounts of memory are allocated.

Services using Compress’ zip package can be attacked using a crafted ZIP archive.

The other vulnerable package the database software uses is Tibco WebFOCUS, which is impacted by a cross-site scripting vulnerability, CVE-2021-35493.

An attacker can use a crafted URL to execute scripts in the victim’s browser, “within the security context of the hosting Web site, once the URL is clicked.

"An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials,” IBM said.