PT-2020-6085 · Ibm · Ibm Db2

Published 2020-06-30 · Updated 2021-07-21 · CVE-2020-4355

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) versions 9.7, 10.1, 10.5, 11.1, and 11.5

Description The issue is related to the improper handling of Secure Sockets Layer (SSL) renegotiation requests, which can lead to a denial of service. By sending specially-crafted requests, a remote attacker could exploit this to increase the resource usage on the system. This could potentially allow an attacker to cause a denial of service by sending these requests.

Recommendations For versions 9.7, 10.1, 10.5, 11.1, and 11.5, consider restricting access to the SSL renegotiation functionality until a patch is available. As a temporary workaround, consider disabling the SSL renegotiation feature to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2021-02973

CVE-2020-4355

Affected Products

Ibm Db2

References · 6

• https://exchange.xforce.ibmcloud.com/vulnerabilities/178507 · Vendor Advisory
• https://ibm.com/support/pages/node/6242350 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-4355 · Security Note
• https://osv.dev/vulnerability/CVE-2020-4355 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02973 · Security Note
• https://t.me/cvenotify/4768 · Telegram Post