CVE-2023-42005 is a high severity flaw (CVSS 7.4) in IBM Db2 and Db2 Warehouse on Cloud Pak for Data. A user with access to the Kubernetes pod could make system calls that compromise the security of the containers. IBM's bulletin names Cloud Pak for Data 4.8.5 as the fix.
What's affected
IBM's bulletin lists the affected releases for Db2 and Db2 Warehouse on Cloud Pak for Data as a group, not per CVE:
- 3.5 through refresh 10
- 4.0 through refresh 9
- 4.5 through refresh 3
- 4.6 through refresh 6
- 4.7 through refresh 4
- 4.8 through refresh 4
The NVD record lists versions 3.5, 4.0, 4.5, 4.6, 4.7 and 4.8, which is the same set at release level. IBM adds the refresh detail. The score is the same in both places, 7.4, with the vector AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, and both describe the flaw the same way. The weakness is CWE-264, a broad class for permissions and access control.
How to check if you're exposed
Find your Cloud Pak for Data release and refresh level. IBM's bulletin points to its own documentation for the version checks and upgrade procedure, so follow those steps for your environment rather than relying on a generic command.
If you run Db2U in a cluster, you can also list the pods in the namespace that hosts Db2 and compare the deployed release with the bulletin:
kubectl get pods -n <your-db2-namespace>
Replace the namespace with your own. Note that the pod list shows what is running, not the Cloud Pak release, so use IBM's version instructions to confirm.
What to do now
- Identify every Cloud Pak for Data instance running Db2 or Db2 Warehouse.
- Compare each against the affected list above.
- Plan the upgrade to Cloud Pak for Data 4.8.5. IBM says the fix can be applied to any affected fix pack and refresh level.
- Follow IBM's upgrade pages for Db2 and Db2 Warehouse under the 4.8.x documentation.
- Until then, restrict who can get shell or exec access to the Db2 pods. IBM lists no workaround, so this is a precaution, not a fix.
Why it matters
The attacker model is a person who already has access to a pod, and the attack complexity is rated high. That is a narrower threat than an internet facing flaw. It still matters in shared clusters, where several teams or contractors can reach pods and where a container is supposed to be a boundary.
The record describes system calls that compromise container security. That is an isolation problem: something a pod user should not be able to do from inside the container becomes possible. IBM does not publish more detail in the bulletin we read, so we do not add any.
The KEV flag in the record is false. Cluster software like this sits below your application dependencies, so it needs its own inventory. A container image scan is a useful companion for the images you run.
Quick check
Is Cloud Pak for Data 4.8.5 the only fix?
IBM's bulletin names 4.8.5 as the fixed version and strongly recommends upgrading to it. Check the bulletin for any interim guidance.
Is there a workaround?
IBM lists none. Limiting pod access is sensible hardening but is not a stated mitigation.
Sources
- IBM support bulletin 7155078
- IBM X-Force entry 265264 (listed in the record, not fetched)
- NVD record for CVE-2023-42005
Last reviewed: 19 October 2026.
