Information disclosure in IBM DB2 LUW - CVE-2023-38729

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU88069

Information disclosure in IBM DB2 LUW - CVE-2023-38729

Published: April 3, 2024


Vulnerability identifier: #VU88069
CSH Severity: Low
CVSS v4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-38729
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A remote user can gain unauthorized access to sensitive information on the system.


Affected software

IBM DB2 LUW
IBM DB2
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Intelligent Operations Center
WebSphere Remote Server
IBM Security Verify Governance
IBM Cloud Application Performance Management (APM)
IBM OpenPages with Watson
Datacap
dashDB Local
DB2 on Cloud Pak for Data
DB2 Warehouse on Cloud Pak for Data
Db2 Big SQL
Storage Protect Server
IBM Cloud Pak System

How to mitigate CVE-2023-38729

Install updates from vendor's website.

IBM DB2 LUW - addressed in versions 10.5 FP11, 11.1.4 FP7, 11.5.0, 11.5.8, 11.5.9
dashDB Local - update to 11.5.9.0
IBM Cloud Pak System - addressed in versions 2.3.4.1, 2.3.5.0
DB2 on Cloud Pak for Data - update to 4.8.5
DB2 Warehouse on Cloud Pak for Data - update to 4.8.5
Db2 Big SQL - update to 7.6.4
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.15
Storage Protect Server - update to 8.1.23
IBM DB2 - addressed in versions 10.5 FP11, 11.1.4.7, 11.5.0.0, 11.5.8, 11.5.9

External References

Related Security Bulletins