IBM Db2 XML External Entity Injection Vulnerability

A vulnerability allowing XML external entity injection (XXE) has been identified in IBM Db2 for Linux, UNIX, and Windows, including Db2 Connect Server, versions 11.5.0 prior to 11.5.9 and 12.1.0 prior to 12.1.3. This vulnerability arises when the application processes XML data, potentially allowing remote attackers to access sensitive information or exhaust memory resources.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information or excessive memory consumption, potentially causing a denial-of-service condition.

Remediation

Users can download special builds containing the interim fix for this vulnerability from Fix Central. These builds are available for Db2 versions 11.5.9, 12.1.2, and 12.1.3. Instructions for downloading these special builds are available on the IBM Support website.