Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM932BBBA4A9FF09C16060C87746CD4412F9EC3B176111B39C3596FC41AAB53513
HistoryApr 05, 2024 - 10:31 p.m.

Security Bulletin: Multiple Vulnerabilities have been identified in IBM Db2 shipped with IBM WebSphere Remote Server

2024-04-0522:31:02
www.ibm.com
11
ibm db2
ibm websphere remote server
sensitive information disclosure
denial of service
open source library vulnerability

6.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

6.1 Medium

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.014 Low

EPSS

Percentile

86.5%

JSON

Summary

IBM Db2 is shipped with IBM WebSphere Remote Server. Information about security vulnerabilities affecting IBM Db2 have been published in a security bulletin CVE-2023-38729, CVE-2012-2677, CVE-2024-25030, CVE-2024-25046, CVE-2024-27254, CVE-2023-52296, CVE-2024-22360

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Affected Product(s) Version(s)
IBM WebSphere Remote Server 9.1, 9.0, 8.5

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now. Refer to the following security bulletins for vulnerability details and information about fixes addressed by IBM Db2 which is shipped with IBM WebSphere Remote Server.

Principal Product and Version(s)

|

Affected Supporting Product and Version

|

Affected Supporting Product Security Bulletin

—|—|—

IBM WebSphere Remote Server
8.5, 9.0, 9.1

|

IBM Db2

10.5, 11.1, 11.5

|

IBM® Db2® is vulnerable to sensitive information disclosure when using ADMIN_CMD with IMPORT or EXPORT (CVE-2023-38729)

IBM WebSphere Remote Server
9.0, 9.5

|

IBM Db2

11.1, 11.5

|

IBM® Db2® is affected by a vulnerability in an open source library boost (CVE-2012-2677)

IBM WebSphere Remote Server
9.0

|

IBM Db2

11.1

|

IBM® Db2® is vulnerable to an information disclosure vulnerability as sensitive information may be included in a log file (CVE-2024-25030)

IBM WebSphere Remote Server
9.0, 9.1

|

IBM Db2

11.1, 11.5

|

Security Bulletin: IBM® Db2® is vulnerable to denial of service with a specially crafted query (CVE-2024-25046)

IBM WebSphere Remote Server
8.5, 9.0, 9.1

|

IBM Db2

10.5, 11.1, 11.5

|

IBM® Db2® is vulnerable to denial of service with a specially crafted query under certain conditions (CVE-2024-27254)

IBM WebSphere Remote Server
9.0, 9.1

|

IBM Db2

11.5

|

IBM® Db2® is vulnerable to denial of service when quering a specific UDF built-in function concurrently (CVE-2023-52296)

IBM WebSphere Remote Server
9.0, 9.1

|

IBM Db2

11.5

|

IBM® Db2® is vulnerable to a denial of service with a specially crafted query on certain columnar tables (CVE-2024-22360)

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmwebsphereMatch9.1
OR
ibmwebsphereMatch9.0
OR
ibmwebsphereMatch8.5

Related

ibm 12
nessus 18
cve 7
cvelist 7
vulnrichment 2
nvd 7
prion 1
openvas 12
redhat 1
veracode 1
centos 1
ubuntucve 1
f5 2
oraclelinux 1
gentoo 1
ibm
ibm
Security Bulletin: Multiple security vulnerabilities have been identified in IBM Db2 shipped with IBM Security Guardium Key Lifecycle Manager (April 2024)
2024-05-17 12:03:54
Security Bulletin: Multiple security vulnerabilities have been identified in IBM DB2 which is shipped with IBM Intelligent Operations Center.
2024-04-05 08:23:20
Security Bulletin: IBM Db2 and IBM WebSphere Application Server traditional used by ISVG - Identity Manager have multiple vulnerabilities
2024-04-17 07:17:22
nessus
nessus
IBM DB2 Multiple Vulnerabilities (7145722, 7145730) (Unix)
2024-06-07 00:00:00
IBM DB2 Multiple Vulnerabilities (7145722, 7145730) (Windows)
2024-06-07 00:00:00
IBM DB2 Multiple Vulnerabilities (7145721, 7145727) (Windows)
2024-06-07 00:00:00
cve
cve
CVE-2024-25030
2024-04-03 13:16:01
CVE-2023-38729
2024-04-03 13:16:00
CVE-2023-52296
2024-04-03 13:16:00
cvelist
cvelist
CVE-2023-38729 IBM Db2 for Linux, UNIX and Windows information disclosure
2024-04-03 12:27:36
CVE-2023-52296 IBM Db2 for Linux, UNIX and Windows denial of service
2024-04-03 12:30:40
CVE-2024-25030
2024-04-03 12:14:19
vulnrichment
vulnrichment
CVE-2024-27254 IBM Db2 for Linux, UNIX and Windows denial of service
2024-04-03 12:24:05
CVE-2023-52296 IBM Db2 for Linux, UNIX and Windows denial of service
2024-04-03 12:30:40
nvd
nvd
CVE-2024-27254
2024-04-03 13:16:02
CVE-2024-25030
2024-04-03 13:16:01
CVE-2024-25046
2024-04-03 13:16:01
prion
prion
Integer overflow
2012-07-25 19:55:00
openvas
openvas
RedHat Update for boost RHSA-2013:0668-01
2013-03-22 00:00:00
Fedora Update for boost FEDORA-2012-9029
2012-07-06 00:00:00
Fedora Update for boost FEDORA-2012-9818
2012-08-30 00:00:00
redhat
redhat
(RHSA-2013:0668) Moderate: boost security update
2013-03-21 00:00:00
veracode
veracode
Denial Of Service (DoS)
2019-01-15 09:00:37
centos
centos
boost security update
2013-03-21 19:01:31
ubuntucve
ubuntucve
CVE-2012-2677
2012-07-25 00:00:00
f5
f5
SOL16946 - Boost memory allocator vulnerability CVE-2012-2677
2015-07-10 00:00:00
K16946 : Boost memory allocator vulnerability CVE-2012-2677
2015-09-15 00:00:00
oraclelinux
oraclelinux
boost security update
2013-03-21 00:00:00
gentoo
gentoo
Boost: Buffer overflow
2021-05-26 00:00:00

6.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

6.1 Medium

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.014 Low

EPSS

Percentile

86.5%

JSON
Related for 932BBBA4A9FF09C16060C87746CD4412F9EC3B176111B39C3596FC41AAB53513
ibm12nessus18cve7cvelist7vulnrichment2nvd7prion1openvas12redhat1veracode1centos1ubuntucve1f52oraclelinux1gentoo1