Good Afternoon COMMON Community! Don’t forget to register for today’s FREE Happy Hour with President and CTO at DXR Security – Carol Woodbury. 4:30 CT – Don’t be late! Register here:

Good Afternoon COMMON Community! Don’t forget to register for today’s FREE Happy Hour with President and CTO at DXR Security – Carol Woodbury. 4:30 CT – Don’t be late! Register here: bit.ly/40MUioZ pic.twitter.com/LVRMXGjRUr

– COMMON – A Users Group (@COMMONug)13:36 – Feb 13, 2023

Security Bulletin: IBM Db2 Web Query for i is vulnerable to arbitrary code execution due to Apache Commons Text [CVE-2022-42889]

Summary

Db2 Web Query is vulnerable to arbitrary code execution due to Apache Commons Text [CVE-2022-42889]. Apache Commons Text is used by IBM Db2 Web Query for i for string functionality. The fix includes Apache Commons Text 1.10.0.

Vulnerability Details

CVEID:   CVE-2022-42889
DESCRIPTION:   Apache Commons Text could allow a remote attacker to execute arbitrary code on the system, caused by an insecure interpolation defaults flaw. By sending a specially-crafted input, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/238560 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Affected Product(s)Version(s)IBM Db2 Web Query for i2.3.0IBM Db2 Web Query for i2.4.0

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now.

Release 2.3.0 and 2.4.0 are supported and can be fixed by applying Program Temporary Fixes (PTFs) to the IBM i.

The PTF numbers containing the fix for this vulnerability are in the following table.

 

Important note:
IBM recommends that all users running unsupported versions of affected products upgrade to a supported and fixed version of affected products.

Workarounds and Mitigations

None

References

Off

Change History

13 Feb 2023: Initial Publication

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an “industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response.” IBM PROVIDES THE CVSS SCORES “”AS IS”” WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY. In addition to other efforts to address potential vulnerabilities, IBM periodically updates the record of components contained in our product offerings. As part of that effort, if IBM identifies previously unidentified packages in a product/service inventory, we address relevant vulnerabilities regardless of CVE date. Inclusion of an older CVEID does not demonstrate that the referenced product has been used by IBM since that date, nor that IBM was aware of a vulnerability as of that date. We are making clients aware of relevant vulnerabilities as we become aware of them. “Affected Products and Versions” referenced in IBM Security Bulletins are intended to be only products and versions that are supported by IBM and have not passed their end-of-support or warranty date. Thus, failure to reference unsupported or extended-support products and versions in this Security Bulletin does not constitute a determination by IBM that they are unaffected by the vulnerability. Reference to one or more unsupported versions in this Security Bulletin shall not create an obligation for IBM to provide fixes for any unsupported or extended-support products or versions.

[{“Business Unit”:{“code”:”BU058″,”label”:”IBM Infrastructure w/TPS”},”Product”:{“code”:”SSTS2D”,”label”:”IBM i 7.3 Preventative Service Planning”},”Component”:””,”Platform”:[{“code”:”PF012″,”label”:”IBM i”}],”Version”:”7.3″,”Edition”:””,”Line of Business”:{“code”:”LOB57″,”label”:”Power”}},{“Business Unit”:{“code”:”BU058″,”label”:”IBM Infrastructure w/TPS”},”Product”:{“code”:”SS9QQS”,”label”:”IBM i 7.4 Preventative Service Planning”},”Component”:””,”Platform”:[{“code”:”PF012″,”label”:”IBM i”}],”Version”:”7.4″,”Edition”:””,”Line of Business”:{“code”:”LOB57″,”label”:”Power”}},{“Business Unit”:{“code”:”BU058″,”label”:”IBM Infrastructure w/TPS”},”Product”:{“code”:”SSAUST”,”label”:”Db2 Web Query for i”},”Component”:””,”Platform”:[{“code”:”PF012″,”label”:”IBM i”}],”Version”:”2.4.0, 2.3.0 “,”Edition”:””,”Line of Business”:{“code”:”LOB57″,”label”:”Power”}},{“Business Unit”:{“code”:”BU058″,”label”:”IBM Infrastructure w/TPS”},”Product”:{“code”:”SWG60″,”label”:”IBM i”},”Component”:””,”Platform”:[{“code”:”PF012″,”label”:”IBM i”}],”Version”:”7.5,7.4,7.3″,”Edition”:””,”Line of Business”:{“code”:”LOB57″,”label”:”Power”}},{“Business Unit”:{“code”:”BU058″,”label”:”IBM Infrastructure w/TPS”},”Product”:{“code”:”SSB23CE”,”label”:”IBM i 7.5 Preventative Service Planning”},”Component”:””,”Platform”:[{“code”:”PF012″,”label”:”IBM i”}],”Version”:”7.5″,”Edition”:””,”Line of Business”:{“code”:”LOB57″,”label”:”Power”}}]

Overcoming Misconceptions to Unlock Data Potential

Mainframes and IBM i systems are still as vital as ever, with the number of transactions they process increasing every year. Today, mainframes process

90% of all credit card transactions

, and

71% of the Fortune 500

trusts them to run their most critical business applications—ensuring security, reliability and scalability.

 
But as businesses are becoming increasingly data-driven, there is a greater need to quickly and easily access data from across the organization, prompting many to make the move to the cloud. This presents new challenges for businesses to overcome. Can a cloud-based environment provide access to all the data needed? What if the data still resides on a mainframe or IBM i system? How do businesses bridge the gap between their mainframe systems and modern cloud environments without disrupting day-to-day operations?

Mainframe modernization, rather than cloud transformation, is the way forward for ensuring integrated, and more agile, data for confident decision-making. According to Forbes, “The mainframe world will continue as it has. If anything, it will probably grow as hybrid approaches show results.” Here, we explore the benefits of mainframe modernization—and how to take advantage.

Streaming Data Enables Real-Time Insight

Heritage systems are still playing a critical role in helping organizations keep pace with modern, evolving business needs. If mainframes or IBM i systems are still serving business needs, they shouldn’t be discarded in favor of cloud transformation—particularly where it may compromise security. Plenty of companies will retain their mainframe systems moving forward, whether out of a need for computing power, security concerns or core business processes.

 
Streaming helps to process large amounts of data from different sources across the business, including mainframes or IBM i platforms. It connects data and drives a variety of use cases, from analytics to artificial intelligence and machine learning. Data streaming is becoming the “secret sauce” of helping businesses remain competitive within their market through real-time insights.

Break Down Data Silos and Access Data

Getting better, faster access to data and gaining greater visibility over data sets is pivotal to organizations as they strive to become data-led. The role that heritage systems play in storing, processing and managing data has never been more important. Indeed, companies are continually looking to streamline so they can improve agility and resilience.

 
There are several factors increasing the desire for better data accessibility and visibility—including the need to provide better customer experience, mitigate compliance risk and enhance security. Environmental, social and governance (ESG) goals must be considered too; in the future, the cloud will play a critical role in automating tasks that will help save on internal computing power.

 
To successfully use data for strategic initiatives and gain a competitive edge, businesses must overcome the limitations of data silos and unlock critical data residing on mainframe and IBM i systems. Instead of building a silo-free IT infrastructure from scratch, businesses should look for data integration solutions that can handle all the underlying complexities of their existing technology stack and work with future investments. This is important as mainframe systems can be challenging to integrate, requiring specialized knowledge. Additionally, without careful integration, new cloud data warehousing platforms will not readily ingest or understand the data that has been unlocked.

The Future of Mainframe and IBM i

Being able to access data in real time, including mainframe or IBM i data, will give organizations a critical advantage—allowing them to boost their service availability, respond to threats faster and reduce their risk of fraud. The cloud-data platforms that organizations deploy alongside their heritage platforms determine the extent of the advantages they obtain. These solutions will need to offer seamless integration so they can keep IT operations in sync with changes made on the mainframe, and they must be secure and reliable.

 
Purpose-built integration tools enable organizations to centralize in the best way possible, allowing them to effortlessly bridge the gap between data silos and their distributed computing platforms. As businesses become more data-driven, hybrid environments will be key for ensuring integrated—and more agile—data for confident decision-making.

 

Utilization case of ushiday’s Code for IBM i-Yoshiki Ushida’s impressions and evaluations of the noteworthy open source “Code for IBM i”-I Magazine | i Magazine

text = Yoshiki Ushida Chubu System

Server-side open source software technology on IBM i reached a tipping point in 2019. It’s a shift in how OSS is delivered from the licensed program 5733-OPS to yum. This has made it possible to speedily apply OSS to IBM i.

But what about the client’s development environment? RPG and CL are SEU (suspended development), and OSS is used as various editors (RDi, VSCode, Eclipse, IDEA, Atom, etc.).

Let’s face it, I am one of them. Especially when it comes to RPG and CL development, I mostly use SEU, which I have been using for many years. For craftsmen (technicians), tools are important business tools, so it is best to use them easily. However, rather than sticking to old tools forever, it is important to try new tools and use both old and new tools well.

Meanwhile, IBM i’s client-side development environment is booming. IBM i Merlin and Code for IBM i. Even the author, who usually uses SEU, is using Code for IBM i more and more. In this article, I will introduce a convenient way to use Code for IBM i.

Here are some of the benefits of Code for IBM i in my personal sense.

①ローカル作業(ソース編集/読み取り)が可能になる

IBM i上のソースをローカルPCのCode for IBM iに取り込むことにより、IBM iに未接続の状態でもローカル環境で作業することができる。筆者は外出や移動があると事前にプログラム・ソースをローカルPCにダウンロードしておき、ネットワーク環境が弱くIBM i上のソースが参照しづらいときに、Code for IBM iを利用することが多い。新幹線の移動中やカフェなどでの待ち時間中に、ソースコードの分析や事前調査をCode for IBM i上で行っている。筆者の場合は、ローカルPCでソースの改修をすることはほぼないが、分析した内容のコメントをソースに埋め込む作業などに活用している。

【手順】

1. 「Code for i – オブジェクト・ブラウザ」でソースコードを”Download”(図表1
2. ローカルPCの適当なフォルダに保存する(図表2)



図表1



図表2

②Git管理に乗せやすい

VSCode自身にGit管理がバンドルされているため、そのままGit管理上にソースを乗せることが容易になる。

【手順(ローカル環境のGitのインストールが必要)】

1. ローカルPCのソースフォルダをgit管理下に置く「git init(ソースフォルダ内)」(図表3
2. 各種 git コマンドによる管理
3. VSCodeのGitLens 拡張機能などでさらに管理しやすく(図表4



図表3



図表4

③タイムライン機能が使える

 Git管理とは別に、VSCodeのタイムライン機能で、ローカル・ヒストリー(変更履歴)が管理できる。VSCodeでは、ローカルで作業した変更も随時保存してくれるので、ちょっとした変更でGit上に履歴が残っていないケースでも、タイムライン機能で確認できる。編集ミスをしていても簡単にロールバックが可能だ。これがSEUだと、メンバーをコピーしゴミメンバーが増えてしまう悪癖を何度も見てきている。

【手順】

1. 左の“エクスプローラ”から、該当ファイルを右クリック → [ タイムラインを開く ] (図表5



図表5

④アウトライン機能が使える

VSCodeのアウトライン機能で、変数、Data Struc
ture、サブルーチンの全体構造がわかり、該当ソースコードへのジャンプが可能。長いステップ数のソースの分析などで、サブルーチンへジャンプするときに役立つ。

【手順】

1. 左の“エクスプローラ”から、該当ファイルを選択 → “アウトライン”を展開する(図表6



図表6

⑤高度な検索機能が使える

 SEUではできない正規表現を使用した、ソース検索が可能。SUEの場合は、ワイルドカードや正規表現パターンを使用した検索はできないため、意図していない検索結果も拾ってしまうが、正規表現を使用して柔軟に検索ができる。さらにプロジェクト内の検索結果の場合は、結果をコピー&ペーストで出力してその後の作業に使うことも可能である。

【手順】 

1. ソースコード検索:ソース内で”Ctrl + F”で検索窓を表示し、検索値を入力する(画面7
2. メンバー(プロジェクト)検索:左の”虫眼鏡”マークをクリックで”Ctrl + F”で検索窓を表示し、検索値を入力する(画面8、画面9



図表7



図表8



図表9

⑥ソースの差分を出力が使える

変更前ソース、変更後ソースの差分を抽出し、開発者が変更後のコードレビューする際に使用する。筆者のチームでは、開発者が責任者に開発後のソースコードをレビューすることになっているが、変更時はソースの差分で会話することが多々ある。IBM iでもCMPPFMというコマンドは用意されているが、変更分が大量だと見づらい。そんなとき、Code for IBM iやVSCodeのソース差分出力機能を使えばレビュー作業もスムーズに進む。

【手順】

1. git履歴比較:該当ファイルを右クリック→[ Commit Changes ]…(画面10
2. 任意比較:該当ファイルを右クリック → 比較元[ 比較対象の選択/Select for Compare ] → 比較先 [選択項目と比較/Compare with Selected]



図表10

⑦ローカル編集→リモート・コンパイルが可能になる 

ローカルPCで編集した場合でも、その内容をIBM i上のIFSに保存し、連続コンパイルすることも可能。しかもこれら一連の流れは、Code for IBM iのアクション機能で、ファイルの拡張子に連動した、リモートコマンドの振る舞いを行うことができる。たとえば、*.rpgle”の場合は、IFSアップロード → CRTBNDRPGを行うなど。

【手順】 

1. 上部 [表示]→[コマンドパレット]を選択
2. ”IBM i Launch Action Setup”を選択(画面11
3. Actionを定義するファイルのタイプを選択する(画面12
4. 左ペインの[IBM i]でIBM iに接続
5. ライブラリリスト(USER LIBRARY LIST)と現行ライブラリ(コンパイル先)を設定する
6. IFS BROWSER でソースのアップロード先を指定し、右クリックし[Change working directory]をクリックする
7. IFSにアップロード、コンパイルするファイルを選択肢 [Ctrl + E]を押下する。実行コマンド(画面13)とアップロード対象ファイルを選択(画面14
8. 下ペインの[Output]→[出力]でコンパイル結果を確認する(画面15



図表11



図表12



図表13



図表14



図表15

まとめ

筆者の場合は、本格的な開発やスクラッチでの利用よりも、開発における補助的な利用が多い。しかしSEUにはない機能の活用により開発効率の向上に非常に役立っており、Code for IBM iはVSCodeとIBM iのベストな橋渡し役だと言える。「すべての開発をCode for IBM iで」と考えるのではなく、まずは効率よく利用できるところから試してみてはどうだろうか。

[i Magazine・IS magazine]

Chubu System Co., Ltd.
President

Joined Chubu System in 2001. As an RPG engineer, he has been in charge of many commissioned development projects. At the same time, he is also learning open source and actively participates in community activities. He has a deep knowledge of PHP, JavaScript, Node.js, etc. He also actively speaks on Twitter and Qiita. Current position from 2021.

Verified by MonsterInsights