CVE-2023-47152 is a medium severity flaw in IBM Db2 11.5, scored 5.9, covering an insecure cryptographic algorithm and information disclosure through a stack trace under exceptional conditions. IBM provides special builds for 11.5. Apply the one for your platform and contact Db2 support for the driver file.
What's affected
IBM's bulletin lists IBM Db2 11.5.x Client, with all platforms affected. The fix is an interim special build, tracked as APAR DT255114. IBM provides builds for V11.5.0 on AIX, and for V11.5.8 and V11.5.9 on AIX, Linux on x86, Linux on POWER little endian, Linux on System z, and Windows. They can be applied at any affected fix pack level.
A change entry dated 7 March 2024 adds that you should contact Db2 support to obtain db2jcc4.jar. That points to the Java client driver as part of the fix. The fix pack column reads TBD.
The record and IBM agree on 5.9 and on a network vector with high attack complexity. The NVD record also lists IBM AIX and Linux on IBM Z among affected platforms, and the record also references a NetApp advisory for the same CVE, which I did not read.
The NVD record was published on 2024-01-22, scores 5.9 (Medium), and carries the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. Weakness class: CWE-209.
How to check if you're exposed
Find Db2 and client driver versions across your environment.
db2level
Run db2level on each host with Db2 or the Db2 client. For Java applications, find the db2jcc4.jar files in use, since the bulletin points to that driver, and record their file versions with your build tools. Compare the results with IBM's list of affected levels and special builds.
What to do now
- Inventory Db2 servers, clients and any applications that bundle db2jcc4.jar.
- Contact Db2 support for the fixed driver, and apply the special build for your platform.
- Redeploy applications that carry their own copy of the driver.
- Make sure application error pages and logs do not expose stack traces to end users.
- Update your inventory so the driver version is tracked from now on.
Why it matters
The record tags the issue as CWE-209, information exposure through an error message. A stack trace can reveal class names, internal paths and library versions, which helps an attacker target later steps. The insecure algorithm in the same description is a separate concern, since weaker cryptography reduces protection for data in transit.
Both parts are about trust in the client side of the connection. The difficulty for teams is that drivers are often copied into application bundles, so a server patch does not touch them. The record's KEV flag is false, so this CVE is not on the CISA Known Exploited Vulnerabilities list.
A component inventory makes it practical to find every copy of a driver like db2jcc4.jar.
Quick check
Do I need to patch the server or the client?
IBM's bulletin lists the 11.5.x Client, and says to contact support for db2jcc4.jar. Check each application that bundles the driver as well as your Db2 installs.
Sources
Last reviewed: 19 October 2026.
