PT-2023-5544 · Ibm · Ibm Db2

CVE-2023-29256 · Publicado 2023-07-07 · Atualizado 2023-07-31

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) versions 10.5, 11.1, and 11.5

Description The issue is related to improper privilege management when certain federation features are used, which may allow a remote attacker to gain access to confidential information. This is due to insufficient access control in the system.

Recommendations For versions 10.5, 11.1, and 11.5, update to a version that properly manages privileges for federation features to prevent information disclosure. As a temporary workaround, consider restricting access to federation features until a patch is available. Avoid using federation features in sensitive environments until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

BDU:2023-06195

CVE-2023-29256

Produtos afetados

Ibm Db2

Referências · 7

• https://osv.dev/vulnerability/CVE-2023-29256 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/252046 · Aviso do Fabricante
• https://ibm.com/support/pages/node/7010573 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-29256 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-06195 · Nota de Segurança
• https://t.me/cvenotify/55614 · Publicação no Telegram
• https://security.netapp.com/advisory/ntap-20230731-0007 · Nota