CVE-2023-29257: High severity ibm cloud pak for business automation vulnerability

Q: What is the severity of CVE-2023-29257?

The severity of CVE-2023-29257 is high with a severity value of 7.2.

Q: What is IBM Db2 for Linux, UNIX, and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5?

IBM Db2 is a database management system for Linux, UNIX, and Windows that includes the Db2 Connect Server.

Q: How does CVE-2023-29257 impact IBM Db2?

CVE-2023-29257 allows a database administrator of one database to execute code or read/write files from another database within the same instance in IBM Db2.

Q: Which versions of IBM Db2 are affected by CVE-2023-29257?

Versions 10.5, 11.1, and 11.5 of IBM Db2 are affected by CVE-2023-29257.

Q: How can I fix CVE-2023-29257?

To fix CVE-2023-29257, it is recommended to apply the necessary patches or updates provided by IBM Db2.

Published Apr 26, 2023

Updated

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to remote code execution as a database administrator of one database may execute code or read/write files from another database within the same instance. IBM X-Force ID: 252011.

Affected Software

26 affected components

IBM Cloud Pak for Business Automation<=V22.0.2 - V22.0.2-IF004

IBM Cloud Pak for Business Automation<=V21.0.3 - V21.0.3-IF020

IBM Cloud Pak for Business Automation<=V22.0.1 - V22.0.1-IF006 and later fixesV21.0.2 - V21.0.2-IF012 and later fixesV21.0.1 - V21.0.1-IF007 and later fixesV20.0.1 - V20.0.3 and later fixesV19.0.1 - V19.0.3 and later fixesV18.0.0 - V18.0.2 and later fixes

IBM DB2>=11.1<11.1.4

IBM DB2>=11.5<11.5.8

IBM DB2=10.5

IBM DB2=10.5-fp1

IBM DB2=10.5-fp10

IBM DB2=10.5-fp2

IBM DB2=10.5-fp3

IBM DB2=10.5-fp3a

IBM DB2=10.5-fp4

IBM DB2=10.5-fp5

IBM DB2=10.5-fp6

IBM DB2=10.5-fp7

IBM DB2=10.5-fp8

IBM DB2=10.5-fp9

IBM DB2=11.1.4

IBM DB2=11.1.4-fp1

IBM DB2=11.1.4-fp2

IBM DB2=11.1.4-fp3

IBM DB2=11.1.4-fp4

IBM DB2=11.1.4-fp5

IBM DB2=11.1.4-fp6

Linux Linux kernel

Microsoft Windows

Remediation

Patch Available

https://www.ibm.com/support/pages/node/6985691

Event History

Apr 26, 2023

CVE Published

01:15 PM

Parent advisories

This vulnerability appears in the following advisories.

IBM-6998727

Frequently Asked Questions

What is the severity of CVE-2023-29257?

The severity of CVE-2023-29257 is high with a severity value of 7.2.

What is IBM Db2 for Linux, UNIX, and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5?

IBM Db2 is a database management system for Linux, UNIX, and Windows that includes the Db2 Connect Server.

How does CVE-2023-29257 impact IBM Db2?