CVE-2023-50308: 
IBM Db2 vulnerability analysis and mitigation

IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 contains a vulnerability that could allow an authenticated user to cause a denial of service when executing statements on columnar tables under certain circumstances. The vulnerability was assigned CVE-2023-50308 and was disclosed on January 22, 2024 (IBM Advisory).

The vulnerability has been assigned a CVSS v3.1 Base Score of 6.5 (MEDIUM) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. This indicates that the vulnerability requires network access and low privileges to exploit, with no user interaction needed, and can result in high availability impact (NetApp Advisory).

Successful exploitation of this vulnerability could allow an authenticated user with database access to cause a denial of service condition specifically when running statements on columnar tables (IBM Advisory).

IBM has released special builds containing interim fixes for this vulnerability, available for V11.5.9 and applicable to all affected fixpack levels. The fixes can be downloaded from Fix Central for various platforms including AIX, Linux, and Windows. No workarounds are currently available (IBM Advisory).