PT-2020-21429 · Ibm · Ibm Db

Published 2020-09-03 · Updated 2020-09-03

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ibm db versions prior to 2.6.0

Description The issue concerns Sensitive Data Exposure. In debug mode, the package logs database credentials in plaintext.

Recommendations Upgrade to version 2.6.0 or later and ensure sensitive information was not logged.

Fix

Related Identifiers

GHSA-P77H-HV6G-FMFP

Affected Products

Ibm Db

References · 6

• https://osv.dev/vulnerability/GHSA-p77h-hv6g-fmfp · Vendor Advisory
• https://github.com/ibmdb/node-ibm_db/issues/563 · Note
• https://github.com/ibmdb/node-ibm_db · Note
• https://github.com/ibmdb/node-ibm_db/commit/526c88b5eedc605274def65405279f6708d91ce8 · Note
• https://snyk.io/vuln/SNYK-JS-IBMDB-459762 · Note
• https://npmjs.com/advisories/1185 · Note