Resource exhaustion in IBM DB2 LUW - CVE-2023-29267

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU94728

Resource exhaustion in IBM DB2 LUW - CVE-2023-29267

Published: July 25, 2024


Vulnerability identifier: #VU94728
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-29267
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability occurs when selecting from certain types of tables. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.


Affected software

IBM DB2 LUW
IBM License Metric Tool
IBM Security Guardium Key Lifecycle Manager (GKLM)
WebSphere Remote Server
IBM Security Verify Governance
IBM Tivoli Business Service Manager
IBM Cloud Application Performance Management (APM)
IBM Cloud Pak for Business Automation
Db2 Big SQL
IBM OpenPages with Watson
Datacap
Storage Protect Server
IBM Cloud Pak System

How to mitigate CVE-2023-29267

Install updates from vendor's website.

IBM DB2 LUW - addressed in versions 11.1.4 FP7, 11.5.8, 11.5.9
Db2 Big SQL - update to 7.6.8
IBM Cloud Pak System - addressed in versions 2.3.4.1, 2.3.5.0
IBM Tivoli Business Service Manager - update to 6.2.0.5.5
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.4
Storage Protect Server - update to 8.1.24
IBM Cloud Pak for Business Automation - addressed in versions 24.0.0-IF004, 24.0.1-IF001

External References

Related Security Bulletins