CVE-2021-29702 — Injection in IBM DB2 FOR Linux Unix AND Windows

CWE-74 — Injection3 documents3 sources
Severity
7.5HIGHNVD
EPSS
0.8%
top 26.72%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
IBM DB2IBM DB2 FOR Linux Unix AND Windows
Timeline
PublishedJun 16
Latest updateMay 24

Description

Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1.4 and 11.5.5 is vulnerable to a denial of service as the server terminates abnormally when executing a specially crafted SELECT statement. IBM X-Force ID: 200658.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5ibm/db2_for_linux_unix_and_windows11.1.4, 11.5.5+1
▶NVDibm/db211.1 — 11.1.4+1

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-q3qc-r35h-g8rv: Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11↗2022-05-24
▶
CVEList
CVE-2021-29702: Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11↗2021-06-16
▶
CVE-2021-29702 — Injection in IBM | cvebase