CVE-2024-40679 Details
Description
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to an information disclosure vulnerability as sensitive information may be included in a log file under specific conditions.
An information disclosure vulnerability has been identified in IBM Db2 for Linux, UNIX, and Windows, specifically in version 11.5. This vulnerability allows sensitive information to be inadvertently included in a log file under certain conditions. The issue also affects Db2 Connect Server.
Users can download a special build containing the interim fix for this vulnerability from Fix Central. These special builds are available based on the most recent fix pack level for each impacted release. For version 11.5, the special build #50315 or later for V11.5.9 is available. Instructions for downloading this build can be found on the IBM Support page.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 8, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.ibm.com/support/pages/node/7175957 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-532 | Insertion of Sensitive Information into Log File | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ibm db2 | 11.5 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 31, 2025 | Initial Analysis | [email protected] |
| Jan 8, 2025 | New CVE Received | [email protected] |