www.ibm.com
Open in
urlscan Pro
2a02:26f0:2100:296::1e89
Public Scan
URL:
https://www.ibm.com/support/pages/node/6526462
Submission: On August 16 via api from IL — Scanned from DE
Submission: On August 16 via api from IL — Scanned from DE
Form analysis
3 forms found in the DOMPOST /support/pages/node/6526462
<form action="/support/pages/node/6526462" method="post" id="openid-connect-login-form" accept-charset="UTF-8">
<div><input data-drupal-selector="edit-openid-connect-client-generic-login" type="submit" id="edit-openid-connect-client-generic-login" name="generic" value="Log in with Generic" class="button js-form-submit form-submit">
</div><input autocomplete="off" data-drupal-selector="form-r1uiyqn4hliv4-wyla01pvaxcylrpibd2wmgcd-69ds" type="hidden" name="form_build_id" value="form-r1UIYQn4HliV4_WYla01PvaXCYlrpibD2wmGcd_69ds">
<input data-drupal-selector="edit-openid-connect-login-form" type="hidden" name="form_id" value="openid_connect_login_form">
</form>
<form class="ibm-row-form ibm-home-search ibm" enctype="multipart/form-data" id="spng-search" ng-submit="omniType()">
<input id="spng-search-query" class="bx--search-input" name="text" size="40" type="search" autocomplete="off" placeholder="Search support or find a product">
<a title="Search" aria-label="Search" href="#" tabindex="-1" id="spng-search-button" ng-click="omniButton()" class="ibm-search-link common-search-link"></a>
<div id="spng-search-typeahead-wrapper" style="display:none" class="search-results-wrapper">
<div id="spng-search-typeahead" class="common-search-results">
<div id="spng-spinner" style="display:none">
<h2 class="ibm-h2 ibm-h4 ibm-bold"><span class="ibm-spinner"> </span></h2>
</div>
<div id="sp-no-results" style="display:none">
<div class="results">
<p>No results were found for your search query.</p>
<div class="ibm-rule">
<hr>
</div>
<h5 class="ibm-h5"><strong>Tips</strong></h5>
<p>To return expected results, you can:</p>
<ul>
<li><strong>Reduce the number of search terms.</strong> Each term you use focuses the search further.</li>
<li><strong>Check your spelling.</strong> A single misspelled or incorrectly typed term can change your result.</li>
<li><strong>Try substituting synonyms for your original terms.</strong> For example, instead of searching for "java classes", try "java training"</li>
<li><strong>Did you search for an IBM acquired or sold product ?</strong> If so, follow the appropriate link below to find the content you need.</li>
</ul>
</div>
</div>
<div id="sp-doc-failure" style="display:none">
<div class="category">Our apologies</div>
<div class="results">
<p>Search results are not available at this time. Please try again later or use one of the other support options on this page.</p>
</div>
</div>
<div id="sp-prev-products" class="result_section"></div>
<div id="sp-wd-results" class="result_section"></div>
<div id="sp-prod-results" class="result_section"></div>
<div id="sp-doc-results" class="result_section"></div>
</div>
</div>
</form>
POST /support/pages/node/6526462
<form class="node-security-bulletin-6526462-vote-field-was-this-topic-helpful__vote-vote-votingapi-useful-form vote-form" id="vote-form"
data-drupal-selector="node-security-bulletin-6526462-vote-field-was-this-topic-helpful-vote-vote-votingapi-useful-form" action="/support/pages/node/6526462" method="post" accept-charset="UTF-8">
<div class="js-form-item form-item js-form-type-select form-type-select js-form-item-value form-item-value form-no-label">
<select autocomplete="off" data-result-value="-1" data-vote-value="-1" data-style="default" data-show-own-vote="false" data-drupal-selector="edit-value" id="edit-value" name="value" class="form-select select2-widget ibm-widget-processed"
data-jquery-once-autocomplete="true" data-select2-autocomplete-list-widget="true" search-pagesize="10" style="display: none; width: 124px;" tabindex="0" aria-hidden="false">
<option value="-1">Not useful</option>
<option value="1">Useful</option>
</select>
<div class="useful-rating" role="complementary" aria-label="Was this topic helpful?">
<div class="like">
<a href="#"><button aria-label="Yes" tabindex="0" class="ibm-margin-right-1 bx--btn bx--btn--sm bx--btn--tertiary" type="button"><svg focusable="false" preserveAspectRatio="xMidYMid meet" xmlns="http://www.w3.org/2000/svg" fill="currentColor" aria-hidden="true" width="16" height="16" viewBox="0 0 32 32" class="bx--btn__icon"><path d="M26,12H20V6a3.0033,3.0033,0,0,0-3-3H14.8672a2.0094,2.0094,0,0,0-1.98,1.7173l-.8453,5.9165L8.4648,16H2V30H23a7.0078,7.0078,0,0,0,7-7V16A4.0045,4.0045,0,0,0,26,12ZM8,28H4V18H8Zm20-5a5.0057,5.0057,0,0,1-5,5H10V17.3027l3.9578-5.9365L14.8672,5H17a1.0008,1.0008,0,0,1,1,1v8h8a2.0025,2.0025,0,0,1,2,2Z"></path></svg><span class="text-yes">Yes</span><span id="like" style="display:none;">999</span></button></a>
</div>
<div class="dislike">
<a href="#"><button aria-label="No" tabindex="0" class="bx--btn bx--btn--sm bx--btn--tertiary" type="button"><svg focusable="false" preserveAspectRatio="xMidYMid meet" xmlns="http://www.w3.org/2000/svg" fill="currentColor" aria-hidden="true" width="16" height="16" viewBox="0 0 32 32" class="bx--btn__icon"><path d="M30,16V9a7.0078,7.0078,0,0,0-7-7H2V16H8.4648l3.5774,5.3662.8453,5.9165A2.0094,2.0094,0,0,0,14.8672,29H17a3.0033,3.0033,0,0,0,3-3V20h6A4.0045,4.0045,0,0,0,30,16ZM8,14H4V4H8Zm20,2a2.0025,2.0025,0,0,1-2,2H18v8a1.0008,1.0008,0,0,1-1,1H14.8672l-.9094-6.3662L10,14.6973V4H23a5.0057,5.0057,0,0,1,5,5Z"></path></svg><span class="text-no">No</span><span id="dislike" style="display:none;">No</span></button></a>
</div>
</div>
</div>
<input autocomplete="off" data-drupal-selector="form-sqpsqgyhlub6gireg86nkrxzhot5gvyluemtjggilp4" type="hidden" name="form_build_id" value="form-SQPSqgyhluB6gIrEG86nKrXzhoT5GvYlueMTjggiLP4">
<input data-drupal-selector="edit-node-security-bulletin-6526462-vote-field-was-this-topic-helpful-vote-vote-votingapi-useful-form" type="hidden" name="form_id"
value="node_security_bulletin_6526462_vote_field_was_this_topic_helpful__vote_vote_votingapi_useful_form">
<input data-drupal-selector="edit-submit" type="submit" id="edit-submit--2" name="op" value="Save" class="button button--primary js-form-submit form-submit" data-once="drupal-ajax" style="display: none;">
</form>
Text Content
Support My IBM Log in IBM Support No results were found for your search query. -------------------------------------------------------------------------------- TIPS To return expected results, you can: * Reduce the number of search terms. Each term you use focuses the search further. * Check your spelling. A single misspelled or incorrectly typed term can change your result. * Try substituting synonyms for your original terms. For example, instead of searching for "java classes", try "java training" * Did you search for an IBM acquired or sold product ? If so, follow the appropriate link below to find the content you need. Our apologies Search results are not available at this time. Please try again later or use one of the other support options on this page. SECURITY BULLETIN: VULNERABILITY IN APACHE LOG4J AFFECTS SOME FEATURES OF IBM® DB2® (CVE-2021-44228) SECURITY BULLETIN SUMMARY Apache Log4j open source library used by IBM® Db2® is affected by a vulnerability that could allow a remote attacker to execute arbitrary code on the system. This library is used by the Db2 Federation feature. The fix for the vulnerability is to update the log4j library. Please see CVE-2021-4104 for bulletin relating to Log4j V1. Please see CVE-2021-44832, CVE-2021-45046 and CVE-2021-45105 for bulletins relating to Log4j V2. Updating log4j to a version 2.15.0 or higher also addresses CVE-2021-4104. VULNERABILITY DETAILS CVEID: CVE-2021-44228 DESCRIPTION: Apache Log4j could allow a remote attacker to execute arbitrary code on the system, caused by the failure to protect against attacker controlled LDAP and other JNDI related endpoints by JNDI features. By sending a specially crafted code string, an attacker could exploit this vulnerability to load arbitrary Java code on the server and take complete control of the system. Note: The vulnerability is also called Log4Shell or LogJam. CVSS Base score: 10 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/214921 for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) AFFECTED PRODUCTS AND VERSIONS Fix pack levels of IBM Db2 V11.5 for all editions on all platforms are affected only if the following features are configured: Federation: * DVM JDBC wrapper driver, * NoSQL wrapper driver (for Hadoop), * Blockchain wrapper driver (for Hyperledger Fabric, Linux 64-bit, x86-64 only) IBM Db2 V9.7, V10.1, V10.5 and V11.1 are not affected. To determine if Federation is enabled, issue the following: db2 get dbm cfg | grep FEDERATED If a value of NO is returned, you are not vulnerable. You can determine if you are using one of the affected wrappers by performing: To determine if the DVM JDBC wrapper is in use, issue the following statement: db2 "select servername from syscat.serveroptions where option = 'DRIVER_CLASS' and setting = 'com.rs.jdbc.dv.DvDriver'" If a servername is returned, then you are using the DVM JDBC wrapper via the DvDriver class. To determine if the NoSQL hadoop wrapper is in use, issue the following statement: db2 "select * from syscat.servers where servertype = 'HDFSPARQUET'" If 1 or more rows are returned, then NoSQL hadoop wrapper is in use. To determine if the NoSQL Blockchain wrapper is in use, issue the following statement: db2 "select * from syscat.serveroptions where option='PEER_URL'" If 1 or more rows are returned, then NoSQL Blockchain wrapper is in use. REMEDIATION/FIXES Customers running any vulnerable fixpack level of an affected Program, V11.5, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent fixpack level for the V11.5.6 and V11.5.7 release. They can be applied to any affected fixpack level of the appropriate release to remediate this vulnerability. ReleaseFixed in fix packAPARDownload URLV11.5TBD IT39389 Special Build for V11.5.6: AIX 64-bit Linux 32-bit, x86-32 Linux 64-bit, x86-64 Linux 64-bit, POWER™ little endian Linux 64-bit, System z®, System z9® or zSeries® Windows 32-bit, x86 Windows 64-bit, x86 V11.5TBD IT39389 Special Build for V11.5.7: AIX 64-bit Linux 32-bit, x86-32 Linux 64-bit, x86-64 Linux 64-bit, POWER™ little endian Linux 64-bit, System z®, System z9® or zSeries® Windows 32-bit, x86 Windows 64-bit, x86 WORKAROUNDS AND MITIGATIONS A user with SYSADM authority should preform the following: db2stop db2set DB2_JVM_STARTARGS="-Dlog4j2.formatMsgNoLookups=true" db2start GET NOTIFIED ABOUT FUTURE SECURITY BULLETINS Subscribe to My Notifications to be notified of important product support alerts like this. REFERENCES Complete CVSS v3 Guide On-line Calculator v3 Off RELATED INFORMATION IBM Secure Engineering Web Portal IBM Product Security Incident Response Blog See Security Bulletin: Vulnerability in Apache Log4j affects some features of IBM® Db2® (CVE-2021-4104) See Security Bulletin: A vulnerability in Apache Log4j affects some features of IBM® Db2® (CVE-2021-44832) See Security Bulletin: Multiple vulnerabilities in Apache Log4j affects some features of IBM® Db2® (CVE-2021-45046, CVE-2021-45105) ACKNOWLEDGEMENT CHANGE HISTORY 06 June 2022: Updated related links for other Log4j bulletins. 21 Dec 2021: Links for 11.5.7 Windows 32-bit and Windows 64-bit have been added 20 Dec 2021: Links for 11.5.6 Windows 32-bit and Windows 64-bit have been added 16 Dec 2021: Updated to reflect that all Db2 editions are impacted. Added instructions to determine if Federation is enabled. 16 Dec 2021: Added fix pack links for 11.5.7 special builds on AIX 64-bit, Linux 64-bit, Linux 64-bit POWER™ little endian 15 Dec 2021: Added fix pack links for 11.5.6 special builds on AIX 64-bit, Linux 32-bit, Linux 64-bit, Linux 64-bit POWER™ little endian, Linux 64-bit System z®, System z9® or zSeries® Added fix pack links for 11.5.7 special builds on Linux 32-bit, Linux 64-bit System z®, System z9® or zSeries® 14 Dec 2021: Initial Publication *The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin. DISCLAIMER According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY. In addition to other efforts to address potential vulnerabilities, IBM periodically updates the record of components contained in our product offerings. As part of that effort, if IBM identifies previously unidentified packages in a product/service inventory, we address relevant vulnerabilities regardless of CVE date. Inclusion of an older CVEID does not demonstrate that the referenced product has been used by IBM since that date, nor that IBM was aware of a vulnerability as of that date. We are making clients aware of relevant vulnerabilities as we become aware of them. "Affected Products and Versions" referenced in IBM Security Bulletins are intended to be only products and versions that are supported by IBM and have not passed their end-of-support or warranty date. Thus, failure to reference unsupported or extended-support products and versions in this Security Bulletin does not constitute a determination by IBM that they are unaffected by the vulnerability. Reference to one or more unsupported versions in this Security Bulletin shall not create an obligation for IBM to provide fixes for any unsupported or extended-support products or versions. DOCUMENT LOCATION Worldwide [{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SSEPGG","label":"DB2 for Linux- UNIX and Windows"},"Component":"","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF016","label":"Linux"},{"code":"PF033","label":"Windows"}],"Version":"11.5","Edition":"","Line of Business":{"code":"LOB10","label":"Data and AI"}}] WAS THIS TOPIC HELPFUL? Not usefulUseful Yes999 NoNo DOCUMENT INFORMATION More support for: DB2 for Linux- UNIX and Windows Software version: 11.5 Operating system(s): AIX, Linux, Windows Document number: 6526462 Modified date: 06 June 2022 UID ibm16526462 Page Feedback Close SHARE YOUR FEEDBACK NEED SUPPORT? * Submit feedback to IBM Support * 1-800-IBM-7378 (USA) * Directory of worldwide contacts Top products & platforms Industries Artificial intelligence Blockchain Business operations Cloud computing Data & Analytics Hybrid cloud IT infrastructure Security Supply chain What is Hybrid Cloud? What is Artificial intelligence? What is Cloud Computing? What is Kubernetes? What are Containers? What is DevOps? What is Machine Learning? IBM Consulting Communities Developer education Support - Download fixes, updates & drivers IBM Research Partner with us - PartnerWorld Training - Courses Upcoming events & webinars Annual report Career opportunities Corporate social responsibility Diversity & inclusion Industry analyst reports Investor relations News & announcements Thought leadership Security, privacy & trust About IBM LinkedIn Twitter Instagram Subscription Center Contact IBM Privacy Terms of use Accessibility United States — English Share your feedback IBM web domains ibm.com, ibm.dev, ibm.org, ibm-zcouncil.com, insights-on-business.com, jazz.net, merge.com, micromedex.com, mobilebusinessinsights.com, promontory.com, proveit.com, ptech.org, resource.com, s81c.com, securityintelligence.com, skillsbuild.org, softlayer.com, storagecommunity.org, strongloop.com, teacheradvisor.org, think-exchange.com, thoughtsoncloud.com, trusteer.com, truven.com, truvenhealth.com, alphaevents.webcasts.com, betaevents.webcasts.com, ibm-cloud.github.io, ibmbigdatahub.com, bluemix.net, mybluemix.net, ibm.net, ibmcloud.com, redhat.com, galasa.dev, blueworkslive.com, swiss-quantum.ch, altoromutual.com, blueworkslive.cn, blueworkslive.com, cloudant.com, ibm.ie, ibm.fr, ibm.com.br, ibm.co, ibm.ca, silverpop.com, community.watsonanalytics.com, eclinicalos.com, datapower.com, ibmmarketingcloud.com, thinkblogdach.com, truqua.com, my-invenio.com, skills.yourlearning.ibm.com, bluewolf.com, asperasoft.com, instana.com, taos.com, envizi.com About cookies on this site Our websites require some cookies to function properly (required). In addition, other cookies may be used with your consent to analyze site usage, improve the user experience and for advertising. For more information, please review your cookie preferences options and IBM’s privacy statement. To provide a smooth navigation, your cookie preferences will be shared across the IBM web domains listed here. Accept all Required only