{"api_version":"1","generated_at":"2026-07-23T12:58:39+00:00","cve":"CVE-2021-39002","urls":{"html":"https://cve.report/CVE-2021-39002","api":"https://cve.report/api/cve/CVE-2021-39002.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2021-39002","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-39002"},"summary":{"title":"CVE-2021-39002","description":"IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.","state":"PUBLIC","assigner":"psirt@us.ibm.com","published_at":"2021-12-09 17:15:00","updated_at":"2022-01-21 14:47:00"},"problem_types":["CWE-327"],"metrics":[],"references":[{"url":"https://security.netapp.com/advisory/ntap-20220114-0002/","name":"https://security.netapp.com/advisory/ntap-20220114-0002/","refsource":"CONFIRM","tags":[],"title":"December 2021 IBM DB2 Vulnerabilities in NetApp Products | NetApp Product Security","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.ibm.com/support/pages/node/6523802","name":"https://www.ibm.com/support/pages/node/6523802","refsource":"CONFIRM","tags":[],"title":"Security Bulletin:  IBM® Db2®  is vulnerable to an information disclosure as it uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. (CVE-2021-39002)","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/213217","name":"ibm-db2-cve202139002-info-disc (213217)","refsource":"XF","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-39002","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39002","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2021","cve_id":"39002","vulnerable":"-1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"hp","cpe5":"hp-ux","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"39002","vulnerable":"-1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"ibm","cpe5":"aix","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"39002","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"db2","cpe6":"10.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"-","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"39002","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"db2","cpe6":"10.5","cpe7":"-","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"39002","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"db2","cpe6":"11.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"39002","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"db2","cpe6":"11.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"-","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"39002","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"db2","cpe6":"9.7","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"39002","vulnerable":"-1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"39002","vulnerable":"-1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"microsoft","cpe5":"windows","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"39002","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"netapp","cpe5":"oncommand_insight","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"39002","vulnerable":"-1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"oracle","cpe5":"solaris","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"-","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2021-39002","qid":"20249","title":"IBM DB2 Information Disclosure Vulnerability (6523806)"},{"cve":"CVE-2021-39002","qid":"20268","title":"IBM DB2 Information Disclosure Vulnerability (6523802)"}]},"source_records":{"cve_program":{"affects":{"vendor":{"vendor_data":[{"vendor_name":"IBM","product":{"product_data":[{"version":{"version_data":[{"version_value":"10.5"},{"version_value":"10.1"},{"version_value":"9.7"},{"version_value":"11.1"},{"version_value":"11.5"}]},"product_name":"DB2 for Linux, UNIX and Windows"}]}}]}},"data_type":"CVE","impact":{"cvssv3":{"BM":{"SCORE":"5.900","A":"N","UI":"N","S":"U","AV":"N","PR":"N","C":"H","AC":"H","I":"N"},"TM":{"E":"U","RC":"C","RL":"O"}}},"data_format":"MITRE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Obtain Information"}]}]},"CVE_data_meta":{"DATE_PUBLIC":"2021-12-08T00:00:00","ASSIGNER":"psirt@us.ibm.com","ID":"CVE-2021-39002","STATE":"PUBLIC"},"references":{"reference_data":[{"title":"IBM Security Bulletin 6523802 (DB2 for Linux, UNIX and Windows)","name":"https://www.ibm.com/support/pages/node/6523802","url":"https://www.ibm.com/support/pages/node/6523802","refsource":"CONFIRM"},{"title":"X-Force Vulnerability Report","name":"ibm-db2-cve202139002-info-disc (213217)","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/213217","refsource":"XF"},{"refsource":"CONFIRM","name":"https://security.netapp.com/advisory/ntap-20220114-0002/","url":"https://security.netapp.com/advisory/ntap-20220114-0002/"}]}},"nvd":{"publishedDate":"2021-12-09 17:15:00","lastModifiedDate":"2022-01-21 14:47:00","problem_types":["CWE-327"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":5},"severity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"AND","children":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ibm:db2:9.7:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ibm:db2:10.1:*:*:*:*:-:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ibm:db2:10.5:-:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ibm:db2:11.1:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ibm:db2:11.5:*:*:*:*:-:*:*","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":false,"cpe23Uri":"cpe:2.3:o:hp:hp-ux:-:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":false,"cpe23Uri":"cpe:2.3:o:ibm:aix:-:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":false,"cpe23Uri":"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":false,"cpe23Uri":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":false,"cpe23Uri":"cpe:2.3:o:oracle:solaris:-:*:*:*:*:*:-:*","cpe_name":[]}]}],"cpe_match":[]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2021","CveId":"39002","Ordinal":"214680","Title":"CVE-2021-39002","CVE":"CVE-2021-39002","Year":"2021"},"notes":[{"CveYear":"2021","CveId":"39002","Ordinal":"1","NoteData":"IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.","Type":"Description","Title":null},{"CveYear":"2021","CveId":"39002","Ordinal":"2","NoteData":"2021-12-09","Type":"Other","Title":"Published"},{"CveYear":"2021","CveId":"39002","Ordinal":"3","NoteData":"2022-01-14","Type":"Other","Title":"Modified"}]}}}