Every CVE Search/ Get API key

CVE-2019-2708

Vulnerability in the Data Store component of Oracle Berkeley DB. Supported versions that are...

3.3 LowFix available

Vulnerability in the Data Store component of Oracle Berkeley DB. Supported versions that are affected are Prior to 6.138, prior to 6.2.38 and prior to 18.1.32. Easily exploitable vulnerability allows low privileged attacker having Local Logon privilege with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Data Store. CVSS 3.0 Base Score 3.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.60%Down 0.2 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 3.3

Vulnerability in the Data Store component of Oracle Berkeley DB. Supported versions that are affected are Prior to 6.138, prior to 6.2.38 and prior to 18.1.32. Easily exploitable vulnerability allows low privileged attacker having Local Logon privilege with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Data Store. CVSS 3.0 Base Score 3.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).

Record
CVE-2019-2708
CVSS 3.0
3.3 LowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0
2.1 LowAV:L/AC:L/Au:N/C:N/I:N/A:P
Updated
2026-11-02
CVE List No score

Vulnerability in the Data Store component of Oracle Berkeley DB. Supported versions that are affected are Prior to 6.138, prior to 6.2.38 and prior to 18.1.32. Easily exploitable vulnerability allows low privileged attacker having Local Logon privilege with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Data Store. CVSS 3.0 Base Score 3.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).

Record
CVE-2019-2708
Updated
2026-11-02
EUVDEUVD-2019-12347 No score

Vulnerability in the Data Store component of Oracle Berkeley DB. Supported versions that are affected are Prior to 6.138, prior to 6.2.38 and prior to 18.1.32. Easily exploitable vulnerability allows low privileged attacker having Local Logon privilege with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Data Store. CVSS 3.0 Base Score 3.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).

Record
EUVD-2019-12347
Updated
2026-11-03
GitHub AdvisoriesGHSA-4h5r-2hfh-8prm No score

Vulnerability in the Data Store component of Oracle Berkeley DB. Supported versions that are...

Vulnerability in the Data Store component of Oracle Berkeley DB. Supported versions that are affected are Prior to 6.138, prior to 6.2.38 and prior to 18.1.32. Easily exploitable vulnerability allows low privileged attacker having Local Logon privilege with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Data Store. CVSS 3.0 Base Score 3.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).

Record
GHSA-4h5r-2hfh-8prm
Updated
2026-11-02
OSVAZL-34927 3.3

CVE-2019-2708 affecting package libdb for versions less than 5.3.28-7

Vulnerability in the Data Store component of Oracle Berkeley DB. Supported versions that are affected are Prior to 6.138, prior to 6.2.38 and prior to 18.1.32. Easily exploitable vulnerability allows low privileged attacker having Local Logon privilege with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Data Store. CVSS 3.0 Base Score 3.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).

Record
AZL-34927
CVSS 3.0
3.3 LowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-05
OSVAZL-6630 3.3

CVE-2019-2708 affecting package libdb for versions less than 5.3.28-7

Vulnerability in the Data Store component of Oracle Berkeley DB. Supported versions that are affected are Prior to 6.138, prior to 6.2.38 and prior to 18.1.32. Easily exploitable vulnerability allows low privileged attacker having Local Logon privilege with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Data Store. CVSS 3.0 Base Score 3.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).

Record
AZL-6630
CVSS 3.0
3.3 LowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
Show 10 moreShow less
OSVBELL-CVE-2019-2708 3.3
Record
BELL-CVE-2019-2708
CVSS 3.0
3.3 LowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2021-1156 3.3

libdb security update

Oracle Berkeley DB provides the best open source embeddable databases allowing developers the choice of SQL, Key/Value, XML/XQuery or Java Object storage for their data model. At its core is a fast, scalable, transactional database engine with proven reliability and availability. Berkeley DB comes three versions: Berkeley DB, Berkeley DB Java Edition, and Berkeley DB XML.

Security Fix(es):

Vulnerability in the Data Store component of Oracle Berkeley DB. Supported versions that are affected are Prior to 6.138, prior to 6.2.38 and prior to 18.1.32. Easily exploitable vulnerability allows low privileged attacker having Local Logon privilege with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Data Store. CVSS 3.0 Base Score 3.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).(CVE-2019-2708)

Record
OESA-2021-1156
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRHSA-2021:1675 3.3

Red Hat Security Advisory: libdb security update

Record
RHSA-2021:1675
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRLSA-2021:1675 3.3

Low: libdb security update

The libdb packages provide the Berkeley Database, an embedded database supporting both traditional and client/server applications.

Security Fix(es):

  • libdb: Denial of service in the Data Store component (CVE-2019-2708)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.4 Release Notes linked from the References section.

Record
RLSA-2021:1675
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVALSA-2021:1675 No score

Low: libdb security update

The libdb packages provide the Berkeley Database, an embedded database supporting both traditional and client/server applications.

Security Fix(es):

  • libdb: Denial of service in the Data Store component (CVE-2019-2708)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2021:1675
Updated
2026-11-02
OSVMGASA-2021-0057 No score

Updated db53 packages fix a security vulnerability

Vulnerability in the Data Store component of Oracle Berkeley DB. Easily exploitable vulnerability allows low privileged attacker having Local Logon privilege with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Data Store (CVE-2019-2708).

Record
MGASA-2021-0057
Updated
2026-11-02
OSVopenSUSE-SU-2024:14246-1 No score

db48-doc-4.8.30-45.1 on GA media

These are all security issues fixed in the db48-doc-4.8.30-45.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14246-1
Updated
2026-11-02
OSVSUSE-SU-2022:4214-1 No score

Security update for libdb-4_8

This update for libdb-4_8 fixes the following issues:

  • CVE-2019-2708: Fixed partial DoS due to data store execution (bsc#1174414).
Record
SUSE-SU-2022:4214-1
Updated
2026-11-02
OSVSUSE-SU-2022:4289-1 No score

Security update for libdb-4_8

This update for libdb-4_8 fixes the following issues:

  • CVE-2019-2708: Fixed partial DoS due to data store execution (bsc#1174414).
Record
SUSE-SU-2022:4289-1
Updated
2026-11-02
OSVSUSE-SU-2025:20067-1 No score

Security update for libdb-4_8

This update for libdb-4_8 fixes the following issues:

CVE-2019-2708: Fixed data store execution leading to partial DoS (bsc#1174414)

Changes:

  • libdb: Data store execution leads to partial DoS

  • Backport the upsteam commits:

    • Fixed several possible crashes when running db_verify on a corrupted database. [#27864]
    • Fixed several possible hangs when running db_verify on a corrupted database. [#27864]
    • Added a warning message when attempting to verify a queue database which has many extent files. Verification will take a long time if there are many extent files. [#27864]
Record
SUSE-SU-2025:20067-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libdb-cxx
AlmaLinux:8
 before 5.3.28-40.el8
5.3.28-40.el8
libdb-cxx-devel
AlmaLinux:8
 before 5.3.28-40.el8
5.3.28-40.el8
libdb-devel-doc
AlmaLinux:8
 before 5.3.28-40.el8
5.3.28-40.el8
libdb-sql
AlmaLinux:8
 before 5.3.28-40.el8
5.3.28-40.el8
libdb-sql-devel
AlmaLinux:8
 before 5.3.28-40.el8
5.3.28-40.el8
libdb
Azure Linux:3
 before 5.3.28-7
5.3.28-7
libdb
Azure Linux:2
 before 5.3.28-7
5.3.28-7
db
Alpaquita:stream
 5.3.28-r2 up to 5.3.28-r6
5.3.28-r6
db53
Mageia:7
 before 5.3.28-17.1.mga7
5.3.28-17.1.mga7
libdb
openEuler:20.03-LTS-SP1
 before 5.3.28-36.oe1
5.3.28-36.oe1
Show 49 moreShow less
Affected packages
PackageAffectedFixed
libdb-cxx-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:5.3.28-40.el8
0:5.3.28-40.el8
libdb-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:5.3.28-40.el8
0:5.3.28-40.el8
libdb-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:5.3.28-40.el8
0:5.3.28-40.el8
libdb-devel
Red Hat:enterprise_linux:8::appstream
 before 0:5.3.28-40.el8
0:5.3.28-40.el8
libdb-java-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:5.3.28-40.el8
0:5.3.28-40.el8
libdb-sql-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:5.3.28-40.el8
0:5.3.28-40.el8
libdb-sql-devel-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:5.3.28-40.el8
0:5.3.28-40.el8
libdb-tcl-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:5.3.28-40.el8
0:5.3.28-40.el8
libdb-utils-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:5.3.28-40.el8
0:5.3.28-40.el8
libdb
Red Hat:enterprise_linux:8::baseos
 before 0:5.3.28-40.el8
0:5.3.28-40.el8
libdb-cxx-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:5.3.28-40.el8
0:5.3.28-40.el8
libdb-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:5.3.28-40.el8
0:5.3.28-40.el8
libdb-debugsource
Red Hat:enterprise_linux:8::baseos
 before 0:5.3.28-40.el8
0:5.3.28-40.el8
libdb-java-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:5.3.28-40.el8
0:5.3.28-40.el8
libdb-sql-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:5.3.28-40.el8
0:5.3.28-40.el8
libdb-sql-devel-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:5.3.28-40.el8
0:5.3.28-40.el8
libdb-tcl-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:5.3.28-40.el8
0:5.3.28-40.el8
libdb-utils
Red Hat:enterprise_linux:8::baseos
 before 0:5.3.28-40.el8
0:5.3.28-40.el8
libdb-utils-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:5.3.28-40.el8
0:5.3.28-40.el8
libdb-cxx
Red Hat:enterprise_linux:8::crb
 before 0:5.3.28-40.el8
0:5.3.28-40.el8
libdb-cxx-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:5.3.28-40.el8
0:5.3.28-40.el8
libdb-cxx-devel
Red Hat:enterprise_linux:8::crb
 before 0:5.3.28-40.el8
0:5.3.28-40.el8
libdb-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:5.3.28-40.el8
0:5.3.28-40.el8
libdb-debugsource
Red Hat:enterprise_linux:8::crb
 before 0:5.3.28-40.el8
0:5.3.28-40.el8
libdb-devel-doc
Red Hat:enterprise_linux:8::crb
 before 0:5.3.28-40.el8
0:5.3.28-40.el8
libdb-java-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:5.3.28-40.el8
0:5.3.28-40.el8
libdb-sql
Red Hat:enterprise_linux:8::crb
 before 0:5.3.28-40.el8
0:5.3.28-40.el8
libdb-sql-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:5.3.28-40.el8
0:5.3.28-40.el8
libdb-sql-devel
Red Hat:enterprise_linux:8::crb
 before 0:5.3.28-40.el8
0:5.3.28-40.el8
libdb-sql-devel-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:5.3.28-40.el8
0:5.3.28-40.el8
libdb-tcl-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:5.3.28-40.el8
0:5.3.28-40.el8
libdb-utils-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:5.3.28-40.el8
0:5.3.28-40.el8
libdb
Rocky Linux:8
 before 0:5.3.28-40.el8
0:5.3.28-40.el8
libdb-4_8
SUSE:Linux Enterprise Micro 5.3
 before 4.8.30-150000.7.6.1
4.8.30-150000.7.6.1
libdb-4_8
SUSE:Linux Enterprise Module for Basesystem 15 SP3
 before 4.8.30-150000.7.6.1
4.8.30-150000.7.6.1
libdb-4_8
SUSE:Linux Enterprise Module for Basesystem 15 SP4
 before 4.8.30-150000.7.6.1
4.8.30-150000.7.6.1
libdb-4_8
SUSE:Linux Enterprise Micro 5.1
 before 4.8.30-150000.7.6.1
4.8.30-150000.7.6.1
libdb-4_8
SUSE:Linux Enterprise Micro 5.2
 before 4.8.30-150000.7.6.1
4.8.30-150000.7.6.1
libdb-4_8
openSUSE:Leap Micro 5.2
 before 4.8.30-150000.7.6.1
4.8.30-150000.7.6.1
libdb-4_8
openSUSE:Leap Micro 5.3
 before 4.8.30-150000.7.6.1
4.8.30-150000.7.6.1
libdb-4_8
openSUSE:Leap 15.3
 before 4.8.30-150000.7.6.1
4.8.30-150000.7.6.1
libdb_java-4_8
openSUSE:Leap 15.3
 before 4.8.30-150000.7.6.1
4.8.30-150000.7.6.1
libdb-4_8
openSUSE:Leap 15.4
 before 4.8.30-150000.7.6.1
4.8.30-150000.7.6.1
libdb_java-4_8
openSUSE:Leap 15.4
 before 4.8.30-150000.7.6.1
4.8.30-150000.7.6.1
libdb-4_8
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 4.8.30-33.1
4.8.30-33.1
libdb-4_8
SUSE:Linux Enterprise Server 12 SP5
 before 4.8.30-33.1
4.8.30-33.1
libdb-4_8
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 4.8.30-33.1
4.8.30-33.1
libdb-4_8
SUSE:Linux Micro 6.0
 before 4.8.30-7.1
4.8.30-7.1
db48
openSUSE:Tumbleweed
 before 4.8.30-45.1
4.8.30-45.1

History

History
RecordedChangedSources
factsOSV
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-2708 is a low vulnerability (CVSS 3.3) in Oracle Berkeley Db, published April 23, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.60%, the 49th percentile. Fixed in libdb-cxx 5.3.28-40.el8.

References

Show 18 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open