CVE-2025-33012 — Use of a Key Past its Expiration Date in IBM DB2

CWE-324 — Use of a Key Past its Expiration Date3 documents3 sources
Severity
8.8HIGHNVD
CNA6.3
EPSS
0.0%
top 95.06%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM DB2
Timeline
PublishedNov 7

Description

IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux could allow an authenticated user to regain access after account lockout due to password use after expiration date.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5ibm/db210.5.0 — 10.5.11+3
▶NVDibm/db210.5.0.0 — 10.5.0.11+3

🔴Vulnerability Details

2
CVEList
IBM Db2 improper account lockout↗2025-11-07
▶
GHSA
GHSA-fgjg-3fmq-57hw: IBM Db2 10↗2025-11-07
▶
CVE-2025-33012 — Use of a Key Past its Expiration Date | cvebase