CVE-2025-33114
BaseFortify
Publication date: 2025-07-29
Last updated on: 2025-08-06
Assigner: IBM Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ibm | db2 | 12.1.0 |
| ibm | db2 | 12.1.1 |
| ibm | db2 | 12.1.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-943 | The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in IBM Db2 for Linux versions 12.1.0, 12.1.1, and 12.1.2 allows an attacker to cause a denial of service (DoS) by sending a specially crafted query under certain non-default conditions. It is classified as CWE-943, which involves improper neutralization of special elements in data query logic. The attack requires network access, has high attack complexity, and low privileges, but it only impacts availability without affecting data confidentiality or integrity. [1]
How can this vulnerability impact me? :
The vulnerability can cause denial of service, meaning the IBM Db2 database service can become unavailable or disrupted when exploited. This impacts the availability of the database system but does not compromise data confidentiality or integrity. There are no workarounds or mitigations other than applying special interim fix builds provided by IBM for affected versions. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
IBM does not disclose detailed vulnerability or replication steps to prevent exploitation. No specific detection commands or methods are provided for identifying this vulnerability on your network or system. [1]
What immediate steps should I take to mitigate this vulnerability?
Apply the special interim fix builds available from IBM Fix Central for affected versions 12.1.1 and 12.1.2. The fix is included in mod pack APAR DT426060, with special builds #62100 or later for 12.1.1 and the latest for 12.1.2. IBM does not provide workarounds or mitigations other than applying these fixes. [1]