Inclusion of Sensitive Information in Log Files in IBM DB2 LUW - CVE-2024-40679

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU104121

Inclusion of Sensitive Information in Log Files in IBM DB2 LUW - CVE-2024-40679

Published: February 21, 2025


Vulnerability identifier: #VU104121
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-40679
CWE-ID: CWE-532
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to software stores sensitive information into log files. A local user can read the log files and gain access to sensitive data.


Affected software

IBM DB2 LUW
IBM Cloud Pak System
IBM Security Guardium Key Lifecycle Manager (GKLM)
WebSphere Remote Server
IBM Security Verify Governance
IBM Security Verify Governance - Containerized Identity Manager
IBM Cloud Application Performance Management (APM)
Datacap
Db2 Big SQL
IBM Virtualization Engine TS7700 3948-VED
System Storage Virtualization Engine TS7700 3948-VEF
Virtualization Engine TS7700 3957-VED

How to mitigate CVE-2024-40679

Install updates from vendor's website.

IBM Cloud Pak System - update to 2.3.6.0
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.4
Db2 Big SQL - update to 8.2
IBM Virtualization Engine TS7700 3948-VED - addressed in versions 8.54.1.27 VTD_EXEC.393, 8.54.2.17 VTD_EXEC.393, 8.60.0.115 VTD_EXEC.393, 8.61.0.60
Virtualization Engine TS7700 3957-VED - addressed in versions 8.54.1.27 VTD_EXEC.393, 8.54.2.17 VTD_EXEC.393, 8.60.0.115 VTD_EXEC.393, 8.61.0.60
System Storage Virtualization Engine TS7700 3948-VEF - addressed in versions 8.60.0.115 VTD_EXEC.393, 8.61.0.60

External References

Related Security Bulletins