RE: DB2 Web Query Security Bulletin

So are you saying these vulnerabilities have been known since then?

-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of Bryan Dietz
Sent: Thursday, January 4, 2024 12:52 PM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: Re: DB2 Web Query Security Bulletin

stirring the pot.

the VMware Tanzu Spring Framework CVEs are dated Apr 17, 2023

one of the apache CVEs is from 2017, the other from early last year


too bad they did not fix

Bryan



Rob Berendt wrote on 1/4/2024 6:47 AM:

This is all just supposition. IDK jack about DB2 Web Query. That
being said here is my two cents worth:
The group PTF for 2.4 is dated 2023-11-17. It says:
...
Planned Update Schedule: Unknown
...
A cursory glance at a PTF or two on that list found no mention of any CVE's.

The group ptf for 2.3 is dated 2023-07-19. It says:
Planned Update Schedule: Please see the withdrawal announcement for
Db2 Web Query for i 2.3.0 at
https://www.ibm.com/docs/en/announcements/withdraw-db2-web-query-i-230
-5733-wqx?region=LA
.

The link above says: Technical support continues to be available
until the end of support date. It also says the end of support for
2.3.0 was October 31, 2023

One could interpret this as, even if there is a security leak, you are
SOL when it comes to getting any fixes for 2.3.

If you go to ibm.com and on their search bar look for: ibm i ptf cover
letters wqx "Web Query 2.3.0"
and sort by newest to oldest, you will not find anything newer than
July 19 of 2023, which was before end of support. Change that 3 to a
4 and you will find newer ones.

Just my daily dose of FUD. Did it work?