IBM Db2 Sensitive Information Disclosure Vulnerability in HADR Configuration

A vulnerability in IBM Db2 for Linux, UNIX, and Windows (including Db2 Connect Server) versions 11.5.0 prior to 11.5.9 and 12.1.0 prior to 12.1.3 could allow an authenticated user to access sensitive information under certain High Availability Disaster Recovery (HADR) configurations.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information.

Remediation

Users can download special builds containing the interim fix for this vulnerability from Fix Central. These builds are available for Db2 versions 11.5.9, 12.1.2, and 12.1.3. Customers should consult the IBM Support page for Db2 V12.1.3 published cumulative special build downloads for more information.