iTnews Asia
  • Home
  • News
  • Security

Third-party bugs squashed in IBM database software

Third-party bugs squashed in IBM database software

Apache Log4j rears its head.

By Richard Chirgwin on Apr 4, 2022 9:35AM

IBM has patched its 'Db2 Web Query for i' software against a number of vulnerabilities inherited from other packages.

Db2 Web Query for i uses the vulnerable Apache Log4j for generating logs and diagnostic traces, IBM’s advisory stated, and needed patching.

Another component, Apache Commons Compress, also carried a vulnerability: CVE-2021-36090, which was discovered last July and IBM describes as a denial of service bug created by an out-of-memory error when large amounts of memory are allocated.

Services using Compress’ zip package can be attacked using a crafted ZIP archive.

The other vulnerable package the database software uses is Tibco WebFOCUS, which is impacted by a cross-site scripting vulnerability, CVE-2021-35493.

An attacker can use a crafted URL to execute scripts in the victim’s browser, “within the security context of the hosting Web site, once the URL is clicked.

"An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials,” IBM said.

To reach the editorial team on your feedback, story ideas and pitches, contact them here.
Copyright © iTnews.com.au . All rights reserved.
Tags:
apache db2 ibm log4j security software tibco vulnerability

Related Articles

  • Your organisation’s physical security can be a gateway for cybercriminals
  • The best way to outsmart your threat actors is to think like one
  • How cybercriminals are exploiting LLMs to harm your business
  • Is identity now the next parameter of cybersecurity breaches?
Share on Twitter Share on Facebook Share on LinkedIn Share on Whatsapp Email A Friend

Most Read Articles

Your organisation’s physical security can be a gateway for cybercriminals

Your organisation’s physical security can be a gateway for cybercriminals

Malaysia's Maxis Berhad investigates claims on alleged data breach

Malaysia's Maxis Berhad investigates claims on alleged data breach

DBS plans US$58 million investment to improve technology resilience

DBS plans US$58 million investment to improve technology resilience

The best way to outsmart your threat actors is to think like one

The best way to outsmart your threat actors is to think like one

All rights reserved. This material may not be published, broadcast, rewritten or redistributed in any form without prior authorisation.
Your use of this website constitutes acceptance of Lighthouse Independent Media's Privacy Policy and Terms & Conditions.