CVEvulnerability
CVE-2018-1426
9.1 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2018-03-22
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.4 HIGH — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- CVSS 3.0 ([email protected])
- 9.1 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- CVSS 2.0 ([email protected])
- 6.4 MEDIUM — AV:N/AC:L/Au:N/C:P/I:P/A:N
- Weaknesses
- CWE-335
Description
IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) duplicates the PRNG state across fork() system calls when multiple ICC instances are loaded which could result in duplicate Session IDs and a risk of duplicate key material. IBM X-Force ID: 139071.
Affected configurations
• ibm db2 9.7
• ibm db2 10.1
• ibm db2 10.5
• ibm db2 11.1
Related
Weakness · CWE (1)
- CWE-335 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) weakness
References
- http://www.ibm.com/support/docview.wss?uid=swg22013756 Vendor Advisory
- http://www.securityfocus.com/bid/105580 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1041012 Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/139071 VDB Entry, Vendor Advisory
- http://www.ibm.com/support/docview.wss?uid=swg22013756 Vendor Advisory
- http://www.securityfocus.com/bid/105580 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1041012 Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/139071 VDB Entry, Vendor Advisory