CVE-2018-1426: Critical severity ibm db2 universal database vulnerability
Published Mar 22, 2018
·Updated
IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) duplicates the PRNG state across fork() system calls when multiple ICC instances are loaded which could result in duplicate Session IDs and a risk of duplicate key material. IBM X-Force ID: 139071.
Affected Software
6 affected components
IBM DB2=9.7
IBM DB2=10.1
IBM DB2=10.5
IBM DB2=11.1
Linux Linux kernel
Microsoft Windows
Event History
Mar 22, 2018
CVE Published
via MITRE·12:00 PM
Data Sourced
via MITRE·12:00 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2018-1426?
CVE-2018-1426 has a medium severity rating due to the potential for session ID duplication.
2
How can I mitigate CVE-2018-1426?
To fix CVE-2018-1426, update to the patched versions of IBM Db2 that address this vulnerability.
3
What versions of IBM Db2 are affected by CVE-2018-1426?
CVE-2018-1426 affects IBM Db2 versions 9.7, 10.1, 10.5, and 11.1.
4
What impact does CVE-2018-1426 have on data security?
CVE-2018-1426 could lead to duplicate session IDs, posing a risk of unauthorized access and data integrity issues.
5
Is CVE-2018-1426 related to the use of fork() system calls?
Yes, CVE-2018-1426 is caused by the duplication of PRNG state across fork() system calls.