PT-2023-14403 · Ibm · Ibm Toolbox For Java

Published 2023-04-07 · Updated 2023-04-13 · CVE-2022-43928

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Toolbox for Java (Db2 Mirror for i) versions 7.4 through 7.5

Description The issue allows a user to obtain sensitive information due to the utilization of a Java string for processing. Since Java strings are immutable, their contents exist in memory until garbage collected, making sensitive data visible in memory over an indefinite amount of time. The problem has been addressed by reducing the amount of time the sensitive data is visible in memory.

Recommendations For versions 7.4 and 7.5, update to a version where the issue has been addressed by reducing the amount of time the sensitive data is visible in memory. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2022-43928

Affected Products

Ibm Toolbox For Java

References · 5

• https://osv.dev/vulnerability/CVE-2022-43928 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43928 · Security Note
• https://ibm.com/support/pages/node/6981113 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/241675 · Vendor Advisory
• https://t.me/cibsecurity/61691 · Telegram Post