CVE-2024-22360: 
IBM Db2 vulnerability analysis and mitigation

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) version 11.5 is affected by a denial of service vulnerability identified as CVE-2024-22360. The vulnerability was discovered and disclosed on April 3, 2024, and involves a specially crafted query on certain columnar tables that could lead to service disruption (IBM Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) by NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, while IBM assessed it with a score of 5.3 (Medium) and vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H. The vulnerability is related to improper input validation (CWE-20) as identified by IBM Corporation (NVD).

When successfully exploited, this vulnerability can result in a denial of service condition affecting the availability of the Db2 database system. The attack requires network access and low privileges, but no user interaction (NetApp Advisory).

The vulnerability requires network access and low privilege level to exploit. The attack complexity is considered high according to IBM's assessment, which suggests that specific conditions need to be met for successful exploitation (IBM Advisory).

IBM has released special builds containing interim fixes for this vulnerability, available for V11.5.8 and V11.5.9. These special builds can be applied to any affected fixpack level to remediate the vulnerability. The fixes are available for various platforms including AIX 64-bit, Linux (32-bit and 64-bit), and Windows (32-bit and 64-bit) systems (IBM Advisory).