Resource exhaustion in IBM DB2 - CVE-2023-25930

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU75479

Resource exhaustion in IBM DB2 - CVE-2023-25930

Published: April 25, 2023


Vulnerability identifier: #VU75479
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-25930
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to setting a special register may cause the Db2 server to terminate abnormally. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.


Affected software

IBM DB2
IBM License Metric Tool
IBM Intelligent Operations Center
IBM Security Verify Governance
IBM Sterling Partner Engagement Manager
IBM Cloud Application Performance Management (APM)
IBM Spectrum Protect Storage Agent
IBM Cloud Pak for Business Automation
DB2 Warehouse on Cloud Pak for Data
DB2 on Cloud Pak for Data
IBM Virtualization Engine TS7700 3948-VED
IBM Cloud Pak System
Virtualization Engine TS7700 3957-VED

How to mitigate CVE-2023-25930

Install updates from vendor's website.

IBM DB2 - addressed in versions 10.5.0.11, 11.1.4.7, 11.5.7, 11.5.8
IBM Cloud Pak System - update to 2.3.3.6 iFix 1
IBM Sterling Partner Engagement Manager - addressed in versions 6.1.2.8, 6.2.0.6, 6.2.1.3, 6.2.2.1
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.4
IBM Spectrum Protect Storage Agent - update to 8.1.19
Virtualization Engine TS7700 3957-VED - update to 8.54.1.27
IBM Virtualization Engine TS7700 3948-VED - update to 8.54.1.27
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.21, 22.0.2.5

External References

Related Security Bulletins