CVE-2019-4102

IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 158092.

CVSS v3 5.9 MEDIUM
CVSS v2.0 4.3 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/109026	Broken Link Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/158092	VDB Entry Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10880743	Patch Vendor Advisory
http://www.securityfocus.com/bid/109026	Broken Link Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/158092	VDB Entry Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10880743	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:ibm:db2:9.7.0.0:::::::*
	cpe:2.3:a:ibm:db2:9.7.0.1:::::::*
	cpe:2.3:a:ibm:db2:9.7.0.2:::::::*
	cpe:2.3:a:ibm:db2:9.7.0.3:::::::*
	cpe:2.3:a:ibm:db2:9.7.0.4:::::::*
	cpe:2.3:a:ibm:db2:9.7.0.5:::::::*
	cpe:2.3:a:ibm:db2:9.7.0.6:::::::*
	cpe:2.3:a:ibm:db2:9.7.0.7:::::::*
	cpe:2.3:a:ibm:db2:9.7.0.8:::::::*
	cpe:2.3:a:ibm:db2:9.7.0.9:::::::*
	cpe:2.3:a:ibm:db2:9.7.0.10:::::::*
	cpe:2.3:a:ibm:db2:9.7.0.11:::::::*
	cpe:2.3:a:ibm:db2:10.1.0.0:::::::*
	cpe:2.3:a:ibm:db2:10.1.0.1:::::::*
	cpe:2.3:a:ibm:db2:10.1.0.2:::::::*
	cpe:2.3:a:ibm:db2:10.1.0.3:::::::*
	cpe:2.3:a:ibm:db2:10.1.0.4:::::::*
	cpe:2.3:a:ibm:db2:10.1.0.5:::::::*
	cpe:2.3:a:ibm:db2:10.1.0.6:::::::*
	cpe:2.3:a:ibm:db2:10.5.0.0:::::::*
	cpe:2.3:a:ibm:db2:10.5.0.1:::::::*
	cpe:2.3:a:ibm:db2:10.5.0.2:::::::*
	cpe:2.3:a:ibm:db2:10.5.0.3:::::::*
	cpe:2.3:a:ibm:db2:10.5.0.4:::::::*
	cpe:2.3:a:ibm:db2:10.5.0.5:::::::*
	cpe:2.3:a:ibm:db2:10.5.0.6:::::::*
	cpe:2.3:a:ibm:db2:10.5.0.7:::::::*
	cpe:2.3:a:ibm:db2:10.5.0.8:::::::*
	cpe:2.3:a:ibm:db2:10.5.0.9:::::::*
	cpe:2.3:a:ibm:db2:10.5.0.10:::::::*
	cpe:2.3:a:ibm:db2:11.1.0.0:::::::*
	cpe:2.3:a:ibm:db2:11.1.1.1:::::::*
	cpe:2.3:a:ibm:db2:11.1.2.2:::::::*
	cpe:2.3:a:ibm:db2:11.1.3.3:::::::*
	cpe:2.3:a:ibm:db2:11.1.4.4:::::::*

OR	cpe:2.3:o:hp:hp-ux:-:::::::*
	cpe:2.3:o:ibm:aix:-:::::::*
	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*
	cpe:2.3:o:oracle:solaris:-::::::-:

History

21 Nov 2024, 04:43

Type	Values Removed	Values Added
References	~~() http://www.securityfocus.com/bid/109026 - Broken Link, Third Party Advisory, VDB Entry~~	() http://www.securityfocus.com/bid/109026 - Broken Link, Third Party Advisory, VDB Entry
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/158092 - VDB Entry, Vendor Advisory~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/158092 - VDB Entry, Vendor Advisory
References	~~() https://www.ibm.com/support/docview.wss?uid=ibm10880743 - Patch, Vendor Advisory~~	() https://www.ibm.com/support/docview.wss?uid=ibm10880743 - Patch, Vendor Advisory

Information

Published : 2019-07-01 15:15

Updated : 2024-11-21 04:43

NVD link : CVE-2019-4102

Mitre link : CVE-2019-4102

CVE.ORG link : CVE-2019-4102

JSON object : View

Products Affected

hp-ux

oracle

solaris

ibm

linux

linux_kernel

microsoft

windows

CWE

CWE-326

Inadequate Encryption Strength

{"id": "CVE-2019-4102", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "published": "2019-07-01T15:15:12.117", "references": [{"url": "http://www.securityfocus.com/bid/109026", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "source": "psirt@us.ibm.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/158092", "tags": ["VDB Entry", "Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://www.ibm.com/support/docview.wss?uid=ibm10880743", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "http://www.securityfocus.com/bid/109026", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/158092", "tags": ["VDB Entry", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.ibm.com/support/docview.wss?uid=ibm10880743", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-326"}]}], "descriptions": [{"lang": "en", "value": "IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 158092."}, {"lang": "es", "value": "IBM DB2 para Linux, UNIX y Windows (incluye DB2 Connect Server) versiones 9.7, 10.1, 10.5, y 11.0 usa algoritmos criptogr\u00e1ficos m\u00e1s d\u00e9biles de lo esperado que permitir\u00eda que un atacante descifre informaci\u00f3n muy confidencial. ID de IBM X-Force: 158092."}], "lastModified": "2024-11-21T04:43:10.823", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:db2:9.7.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "37B04412-3F3F-4918-A1DE-C99AF2EE9605"}, {"criteria": "cpe:2.3:a:ibm:db2:9.7.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A8A8E221-7045-4BAD-9B29-ABBC5216559D"}, {"criteria": "cpe:2.3:a:ibm:db2:9.7.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "56C39DC1-AD23-4F26-9727-EC0FBDF84BEE"}, {"criteria": "cpe:2.3:a:ibm:db2:9.7.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2513D42C-E558-4CC7-88D3-BB44F1B40157"}, {"criteria": "cpe:2.3:a:ibm:db2:9.7.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6F441BE8-AEC0-44F0-875E-03C65A45CF68"}, {"criteria": "cpe:2.3:a:ibm:db2:9.7.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "036E9715-CFAA-4F2A-B432-181EDCA3D812"}, {"criteria": "cpe:2.3:a:ibm:db2:9.7.0.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9A55FBA0-4DFC-493D-91EF-EB56C241F9CE"}, {"criteria": "cpe:2.3:a:ibm:db2:9.7.0.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B539123F-B8AC-4051-9458-A780C68E9667"}, {"criteria": "cpe:2.3:a:ibm:db2:9.7.0.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D3958E50-1F97-4C06-AF22-C635FB2557A0"}, {"criteria": "cpe:2.3:a:ibm:db2:9.7.0.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "57AC4D14-805A-42F6-9348-D13C9A48136F"}, {"criteria": "cpe:2.3:a:ibm:db2:9.7.0.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0B54C55B-9288-4E04-B0D6-6765E5217DFE"}, {"criteria": "cpe:2.3:a:ibm:db2:9.7.0.11:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AA99C5A3-D43E-4942-AE87-8DA46FCDCD47"}, {"criteria": "cpe:2.3:a:ibm:db2:10.1.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BC0406EF-7EEF-4616-B1AD-A6E498FB6516"}, {"criteria": "cpe:2.3:a:ibm:db2:10.1.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E5FA4086-9B5D-4352-B717-3F826DE17D4B"}, {"criteria": "cpe:2.3:a:ibm:db2:10.1.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AD79FF24-6C10-437B-86AF-E211B8C6FDC5"}, {"criteria": "cpe:2.3:a:ibm:db2:10.1.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7ABB145C-44EE-47F5-9439-DE6433F8008E"}, {"criteria": "cpe:2.3:a:ibm:db2:10.1.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0F138E08-6808-4371-9E9C-096B01126B1C"}, {"criteria": "cpe:2.3:a:ibm:db2:10.1.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "813AE6CA-39B5-448C-8781-F2C3B499160A"}, {"criteria": "cpe:2.3:a:ibm:db2:10.1.0.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E19D90B2-0B71-498B-8428-B27950E1D2A7"}, {"criteria": "cpe:2.3:a:ibm:db2:10.5.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1C577979-79CC-4DE2-8433-64595190A5E0"}, {"criteria": "cpe:2.3:a:ibm:db2:10.5.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4B27E1F7-888C-40EE-85FF-B5DC099828C3"}, {"criteria": "cpe:2.3:a:ibm:db2:10.5.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "57DCF076-B475-41E6-B1ED-44FBC99238C2"}, {"criteria": "cpe:2.3:a:ibm:db2:10.5.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BDB1972D-F7FC-4ABA-9DEE-9953D2572944"}, {"criteria": "cpe:2.3:a:ibm:db2:10.5.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D276299-D403-4C41-ACBF-A23383CB3FD6"}, {"criteria": "cpe:2.3:a:ibm:db2:10.5.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5830263A-6970-43B8-BF08-2886327004A6"}, {"criteria": "cpe:2.3:a:ibm:db2:10.5.0.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1F67DD01-F0E6-420E-A144-A8DD001BBBA2"}, {"criteria": "cpe:2.3:a:ibm:db2:10.5.0.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3AA78533-899B-4482-97A7-7E2730C18C7D"}, {"criteria": "cpe:2.3:a:ibm:db2:10.5.0.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E036B621-7EE1-41E0-AAEC-D13FCB17B2EB"}, {"criteria": "cpe:2.3:a:ibm:db2:10.5.0.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5EB95E38-7A78-4798-B0E2-814DAE1153A8"}, {"criteria": "cpe:2.3:a:ibm:db2:10.5.0.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1B95F778-8E2B-4A6D-BA3B-254F87B492BE"}, {"criteria": "cpe:2.3:a:ibm:db2:11.1.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8E17D042-0EE4-4F81-8E39-D8730D792BCE"}, {"criteria": "cpe:2.3:a:ibm:db2:11.1.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "62B40593-EA0D-4134-BBA0-35DA70D3C6B9"}, {"criteria": "cpe:2.3:a:ibm:db2:11.1.2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "177780EE-76F9-41D9-83C9-48C5DFCF8702"}, {"criteria": "cpe:2.3:a:ibm:db2:11.1.3.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3E38BC34-066B-4B4D-929F-4E5C6BCB1442"}, {"criteria": "cpe:2.3:a:ibm:db2:11.1.4.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "23910ECC-960A-44DF-BA8D-C1553D088EAF"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:hp:hp-ux:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F480AA32-841A-4E68-9343-B2E7548B0A0C"}, {"criteria": "cpe:2.3:o:ibm:aix:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E492C463-D76E-49B7-A4D4-3B499E422D89"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}, {"criteria": "cpe:2.3:o:oracle:solaris:-:*:*:*:*:*:-:*", "vulnerable": false, "matchCriteriaId": "F5027746-8216-452D-83C5-2F8E9546F2A5"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@us.ibm.com"}

5.9 /10

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.3 /10

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

JSON object

Attach tags to CVE-2019-4102

5.9^/10

4.3^/10

Attach tags to `CVE-2019-4102`