Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXA3N2gtaHY2Zy1mbWZw

Sensitive Data Exposure in ibm_db

Versions of ibm_db prior to 2.6.0 are vulnerable to Sensitive Data Exposure. The package printed database credentials in plaintext in logs while in debug mode.

Recommendation

Upgrade to version 2.6.0 or later and ensure sensitive information was not logged.

Permalink: https://github.com/advisories/GHSA-p77h-hv6g-fmfp
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXA3N2gtaHY2Zy1mbWZw
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 4 years ago
Updated: over 1 year ago


CVSS Score: 5.0
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Identifiers: GHSA-p77h-hv6g-fmfp
References: Repository: https://github.com/ibmdb/node-ibm_db
Blast Radius: 16.9

Affected Packages

npm:ibm_db
Dependent packages: 84
Dependent repositories: 2,361
Downloads: 41,777 last month
Affected Version Ranges: < 2.6.0
Fixed in: 2.6.0
All affected versions: 0.0.1, 0.0.2, 0.0.3, 0.0.5, 0.0.6, 0.0.8, 0.0.9, 0.0.10, 0.0.11, 0.0.12, 0.0.13, 0.0.14, 0.0.15, 0.0.16, 0.0.17, 0.0.18, 0.0.19, 1.0.0, 1.0.1, 1.0.2, 2.0.0, 2.1.0, 2.2.0, 2.2.1, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.5.3
All unaffected versions: 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.7.0, 2.7.1, 2.7.2, 2.7.3, 2.7.4, 2.8.0, 2.8.1, 2.8.2, 3.0.0, 3.1.0, 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.2.4