Vulnerability · Published Apr 7, 2023 · Assigned by ibm
CVE-2022-43928IBM Db2 Mirror for i information disclosure
Medium 4.9
In plain English
A medium-severity security flaw in Db2 Mirror for i from IBM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).
Official description
The IBM Toolbox for Java (Db2 Mirror for i 7.4 and 7.5) could allow a user to obtain sensitive information, caused by utilizing a Java string for processing. Since Java strings are immutable, their contents exist in memory until garbage collected. This means sensitive data could be visible in memory over an indefinite amount of time. IBM has addressed this issue by reducing the amount of time the sensitive data is visible in memory. IBM X-Force ID: 241675.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| IBM | Db2 Mirror for i | 7.4, 7.5 |