iTnews Asia
  • Home
  • News
  • Security

Third-party bugs squashed in IBM database software

Third-party bugs squashed in IBM database software

Apache Log4j rears its head.

By Richard Chirgwin on Apr 4, 2022 9:35AM

IBM has patched its 'Db2 Web Query for i' software against a number of vulnerabilities inherited from other packages.

Db2 Web Query for i uses the vulnerable Apache Log4j for generating logs and diagnostic traces, IBM’s advisory stated, and needed patching.

Another component, Apache Commons Compress, also carried a vulnerability: CVE-2021-36090, which was discovered last July and IBM describes as a denial of service bug created by an out-of-memory error when large amounts of memory are allocated.

Services using Compress’ zip package can be attacked using a crafted ZIP archive.

The other vulnerable package the database software uses is Tibco WebFOCUS, which is impacted by a cross-site scripting vulnerability, CVE-2021-35493.

An attacker can use a crafted URL to execute scripts in the victim’s browser, “within the security context of the hosting Web site, once the URL is clicked.

"An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials,” IBM said.

To reach the editorial team on your feedback, story ideas and pitches, contact them here.
Copyright © iTnews.com.au . All rights reserved.
Tags:
apache db2 ibm log4j security software tibco vulnerability

Related Articles

  • Wi-Fi protocol vulnerability allows traffic decryption
  • Europol sounds alarm about criminal use of ChatGPT
  • US lawmakers to move forward with TikTok bill
  • TikTok attacked for China ties at US Congress hearing
Share on Twitter Share on Facebook Share on LinkedIn Share on Whatsapp Email A Friend

Most Read Articles

Wi-Fi protocol vulnerability allows traffic decryption

Wi-Fi protocol vulnerability allows traffic decryption

Cisco Catalyst 9300 supply chain vulnerability patched

Cisco Catalyst 9300 supply chain vulnerability patched

US lawmakers to move forward with TikTok bill

US lawmakers to move forward with TikTok bill

Google suspends China's Pinduoduo app over malware

Google suspends China's Pinduoduo app over malware

All rights reserved. This material may not be published, broadcast, rewritten or redistributed in any form without prior authorisation.
Your use of this website constitutes acceptance of Lighthouse Independent Media's Privacy Policy and Terms & Conditions.