CVE-2020-4387 - IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to obtain sensitive information using a race condition of a symbolic link

Back Back to CVE browser

MEDIUM

IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to obtain sensitive information using a race condition of a symbolic link

Published Jul 1, 2020

4.7

MEDIUM

CVSS 3.1

EPSS 0.25%

Description

IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to obtain sensitive information using a race condition of a symbolic link. IBM X-Force ID: 179269.

Affected products

Vendor IBM Product DB2 for Linux- UNIX and Windows Default
n/a
- Version
  10.1
  Status
  affected
  Constraints
  -
- Version
  10.5
  Status
  affected
  Constraints
  -
- Version
  11.1
  Status
  affected
  Constraints
  -
- Version
  11.5
  Status
  affected
  Constraints
  -
- Version
  9.7
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

IBM

DB2 for Linux- UNIX and Windows

n/a

Version	Status	Constraints
10.1	affected	-
10.5	affected	-
11.1	affected	-
11.5	affected	-
9.7	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-362

Race Condition

References (2)

https://exchange.xforce.ibmcloud.com/vulnerabilities/179269
vdb-entryx_refsource_XFVDB EntryVendor Advisory
https://www.ibm.com/support/pages/node/6242336
x_refsource_CONFIRMPatchVendor Advisory

Link	Providers	Tags
https://exchange.xforce.ibmcloud.com/vulnerabilities/179269		vdb-entryx_refsource_XFVDB EntryVendor Advisory
https://www.ibm.com/support/pages/node/6242336		x_refsource_CONFIRMPatchVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner ibm

Published Jul 1, 2020

Updated Sep 16, 2024

Reserved Dec 30, 2019

Link CVE-2020-4387

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2020-4387

Red Hat

Severity n/a

Public date n/a

Links CVE-2020-4387