Resource exhaustion in IBM DB2 LUW - CVE-2023-45193

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU85128

Resource exhaustion in IBM DB2 LUW - CVE-2023-45193

Published: January 9, 2024


Vulnerability identifier: #VU85128
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-45193
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability occurs when a specially crafted cursor is used. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.


Affected software

IBM DB2 LUW
IBM DB2
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Operations Analytics Predictive Insights
IBM Intelligent Operations Center
WebSphere Remote Server
IBM Security Verify Governance
IBM Cloud Application Performance Management (APM)
IBM License Metric Tool
IBM OpenPages with Watson
Datacap
dashDB Local
DB2 Warehouse on Cloud Pak for Data
DB2 on Cloud Pak for Data
Db2 Big SQL
Storage Protect Server

How to mitigate CVE-2023-45193

Install updates from vendor's website.

IBM DB2 LUW - addressed in versions 11.5.8, 11.5.9
dashDB Local - update to 11.5.9.0
DB2 Warehouse on Cloud Pak for Data - update to 4.8.2
DB2 on Cloud Pak for Data - update to 4.8.2
Db2 Big SQL - update to 7.6.4
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.15
Storage Protect Server - update to 8.1.22
IBM DB2 - addressed in versions 11.5.8, 11.5.9

External References

Related Security Bulletins