CVE-2023-29267: IBM Db2 denial of service

Published Jun 12, 2024

Updated

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5is vulnerable to a denial of service, under specific configurations, as the server may crash when using a specially crafted SQL statement by an authenticated user. IBM X-Force ID: 287612.

Affected Software

9 affected components

IBM Db2 Linux=10.5

IBM Db2 Unix=10.5

IBM Db2 Windows=10.5

IBM Db2 Linux=11.1

IBM Db2 Unix=11.1

IBM Db2 Windows=11.1

IBM Db2 Linux=11.5

IBM Db2 Unix=11.5

IBM Db2 Windows=11.5

Event History

Jun 12, 2024

CVE Published

via MITRE·06:24 PM

Data Sourced

via MITRE·06:24 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2023-29267?

CVE-2023-29267 has a severity level that can lead to a denial of service under specific configurations.

How do I fix CVE-2023-29267?

To mitigate CVE-2023-29267, it is recommended to apply the latest patches and updates provided by IBM for affected Db2 versions.

Which versions of IBM Db2 are affected by CVE-2023-29267?

CVE-2023-29267 affects IBM Db2 versions 10.5, 11.1, and 11.5 on Linux, UNIX, and Windows.

Who is impacted by CVE-2023-29267?

Organizations using IBM Db2 with the specified versions may be impacted by CVE-2023-29267 if they have specific configurations in place.

What type of attack does CVE-2023-29267 facilitate?

CVE-2023-29267 facilitates a denial of service attack that can crash the server when executing a crafted SQL statement.