CVE-2018-1426

HIGH

IBM DB2 9.7, 10.1, 10.5, 11.1 - PRNG State Duplication Across fork() System Calls

Title source: llm

Description

IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) duplicates the PRNG state across fork() system calls when multiple ICC instances are loaded which could result in duplicate Session IDs and a risk of duplicate key material. IBM X-Force ID: 139071.

References (4)

Core 4

Core References

Vendor Advisory x_refsource_confirm

http://www.ibm.com/support/docview.wss?uid=swg22013756

VDB Entry, Vendor Advisory x_refsource_misc

https://exchange.xforce.ibmcloud.com/vulnerabilities/139071

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/105580

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1041012

Scores

CVSS v3 7.4

EPSS 0.0251

EPSS Percentile 83.1%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Details

CWE

CWE-335

Status published

Products (4)

ibm/db2 9.7

ibm/db2 10.1

ibm/db2 10.5

ibm/db2 11.1

Published Mar 22, 2018

Tracked Since Feb 18, 2026