CVE-2020-4642: 
IBM Db2 vulnerability analysis and mitigation

IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) versions 9.7, 10.1, 10.5, 11.1, and 11.5 contains a vulnerability that could allow a local attacker to cause a denial of service inside the "DB2 Management Service". This vulnerability was assigned CVE-2020-4642 and was initially recorded on December 30, 2019 (CVE Mitre).

The vulnerability has been assigned a CVSS Base score of 6.2 (Medium) with the following vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The attack requires local access (AV:L), low attack complexity (AC:L), no privileges (PR:N), and no user interaction (UI:N). The scope is unchanged (S:U), with no impact on confidentiality (C:N) or integrity (I:N), but high impact on availability (A:H) (IBM Support).

When successfully exploited, this vulnerability could lead to a denial of service (DoS) condition specifically affecting the DB2 Management Service. The impact is limited to availability with no effect on confidentiality or integrity of the system (NetApp Security).

The vulnerability requires local access to exploit, with no need for special privileges or user interaction. While public discussion of this vulnerability exists, no specific details about active exploitation in the wild have been reported (NetApp Security).

IBM has released special builds containing interim fixes for affected versions. These are available based on the most recent fixpack level for each impacted release: V9.7 FP11, V10.1 FP6, V10.5 FP11, V11.1 FP5, and V11.5.5. The fixes can be applied to any affected fixpack level of the appropriate release. For V11.1, the fix is included in v11.1.4FP6 (IBM Support).