CVE-2025-36131: IBM Db2 information disclosure
IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) clpplus command exposes user credentials to the terminal which could be obtained by a third party with physical access to the system.
Other sources
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) clpplus command exposes user credentials to the terminal which could be obtained by a third party with physical access to the system.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Db2 V11.1to a version that resolves this vulnerability.Patch DT425312 - Upgrade
Upgrade
IBM Db2 V11.5to a version that resolves this vulnerability.Patch DT425312 - Upgrade
Upgrade
IBM Db2 V12.1to a version that resolves this vulnerability.Fixed in 12.1.3Patch DT425312
Event History
Frequently Asked Questions
What is the severity of CVE-2025-36131?
CVE-2025-36131 is considered a medium severity vulnerability due to the potential exposure of user credentials.
How do I fix CVE-2025-36131?
To mitigate CVE-2025-36131, update IBM Db2 to versions above 11.1.4.7, 11.5.9, or 12.1.3.
What systems are affected by CVE-2025-36131?
CVE-2025-36131 affects IBM Db2 versions 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX, and Windows.
What is the risk associated with CVE-2025-36131?
The risk associated with CVE-2025-36131 is that user credentials may be exposed to anyone with physical access to the system.
Is there a workaround for CVE-2025-36131?
There is no official workaround for CVE-2025-36131; upgrading to a secure version is the recommended action.