CVE-2018-1426 — Incorrect Usage of Seeds in Pseudo-Random Number Generator in IBM DB2

CWE-335 — Incorrect Usage of Seeds in Pseudo-Random Number Generator3 documents3 sources
Severity
9.1CRITICALNVD
CNA7.4
EPSS
0.7%
top 28.47%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM DB2
Timeline
PublishedMar 22
Latest updateMay 13

Description

IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) duplicates the PRNG state across fork() system calls when multiple ICC instances are loaded which could result in duplicate Session IDs and a risk of duplicate key material. IBM X-Force ID: 139071.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 3.9 | Impact: 5.2

Affected Packages1 packages

▶NVDibm/db24 versions+3

🔴Vulnerability Details

2
GHSA
GHSA-x5r5-q987-6xf6: IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9↗2022-05-13
▶
CVEList
CVE-2018-1426: IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9↗2018-03-22
▶
CVE-2018-1426 — IBM DB2 vulnerability | cvebase