CVE-2018-1426

critical

Description

IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) duplicates the PRNG state across fork() system calls when multiple ICC instances are loaded which could result in duplicate Session IDs and a risk of duplicate key material. IBM X-Force ID: 139071.

References

http://www.ibm.com/support/docview.wss?uid=swg22013756

http://www.securityfocus.com/bid/105580

http://www.securitytracker.com/id/1041012

https://exchange.xforce.ibmcloud.com/vulnerabilities/139071

Details

Source: MITRE

Published: 2018-03-22

Updated: 2020-08-24

Type: CWE-335

Risk Information

CVSS v2

Base Score: 6.4

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N

Impact Score: 4.9

Exploitability Score: 10

Severity: MEDIUM

CVSS v3

Base Score: 9.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Impact Score: 5.2

Exploitability Score: 3.9

Severity: CRITICAL