CVE-2020-4355: Medium severity ibm db2 universal database vulnerability
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) is vulnerable to a denial of service, caused by improper handling of Secure Sockets Layer (SSL) renegotiation requests. By sending specially-crafted requests, a remote attacker could exploit this vulnerability to increase the resource usage on the system.
Other sources
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a denial of service, caused by improper handling of Secure Sockets Layer (SSL) renegotiation requests. By sending specially-crafted requests, a remote attacker could exploit this vulnerability to increase the resource usage on the system. IBM X-Force ID: 178507.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2020-4355?
CVE-2020-4355 has a severity rating of Medium due to its potential for causing a denial of service.
How do I fix CVE-2020-4355?
To fix CVE-2020-4355, you should apply the latest security updates provided by IBM for the affected versions of DB2.
What versions of IBM DB2 are affected by CVE-2020-4355?
CVE-2020-4355 affects IBM DB2 versions 9.7.0.0, 10.1.0.0, 10.5.0.0, 11.1.0.0, and 11.5.0.0.
What attack vector is associated with CVE-2020-4355?
CVE-2020-4355 can be exploited through remote attacks leveraging specially-crafted SSL renegotiation requests.
Is CVE-2020-4355 specific to any operating system?
CVE-2020-4355 is not limited to any specific operating system but affects the listed versions of IBM DB2 running on Linux, UNIX, and Windows.