PT-2023-5544 · Ibm · Ibm Db2

Published 2023-07-07 · Updated 2023-07-31 · CVE-2023-29256

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) versions 10.5, 11.1, and 11.5

Description The issue is related to improper privilege management when certain federation features are used, which may allow a remote attacker to gain access to confidential information. This is due to insufficient access control in the system.

Recommendations For versions 10.5, 11.1, and 11.5, update to a version that properly manages privileges for federation features to prevent information disclosure. As a temporary workaround, consider restricting access to federation features until a patch is available. Avoid using federation features in sensitive environments until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2023-06195

CVE-2023-29256

Affected Products

Ibm Db2

References · 7

• https://osv.dev/vulnerability/CVE-2023-29256 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/252046 · Vendor Advisory
• https://ibm.com/support/pages/node/7010573 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29256 · Security Note
• https://bdu.fstec.ru/vul/2023-06195 · Security Note
• https://t.me/cvenotify/55614 · Telegram Post
• https://security.netapp.com/advisory/ntap-20230731-0007 · Note