CVE-2020-4355: 
IBM Db2 vulnerability analysis and mitigation

IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) versions 9.7, 10.1, 10.5, 11.1, and 11.5 was identified with a vulnerability (CVE-2020-4355) related to improper handling of Secure Sockets Layer (SSL) renegotiation requests. The vulnerability was discovered and assigned on December 30, 2019 (CVE MITRE).

The vulnerability is caused by improper handling of SSL renegotiation requests in IBM DB2. The CVSS Base score for this vulnerability is 5.3 with a vector of (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), indicating a medium severity issue (IBM Support).

When exploited, this vulnerability could allow a remote attacker to cause a denial of service condition by sending specially-crafted requests that increase system resource usage (IBM Support).

The vulnerability can be exploited remotely by sending specially-crafted SSL renegotiation requests to the affected DB2 system. No authentication is required to exploit this vulnerability (IBM Support).

IBM has released special builds containing interim fixes for all affected versions. These builds are available based on the most recent fixpack level for each impacted release: V9.7 FP11, V10.1 FP6, V10.5 FP11, 11.1 FP5, and V11.5 GA. The fixes can be downloaded from Fix Central and applied to any affected fixpack level of the appropriate release (IBM Support).