{"id":"GHSA-p77h-hv6g-fmfp","aliases":[],"status":"published","title":"Sensitive Data Exposure in ibm_db","description":"Versions of `ibm_db` prior to 2.6.0 are vulnerable to Sensitive Data Exposure. The package printed database credentials in plaintext in logs while in debug mode.\n\n\n## Recommendation\n\nUpgrade to version 2.6.0 or later and ensure sensitive information was not logged.","severity":{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2020-09-03T20:43:16Z","modified":"2023-01-09T05:03:49Z","fixes":[{"ecosystem":"npm","package":"ibm_db","fixed_in":["2.6.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"ibm_db","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0"}]}]},{"source":"osv","ecosystem":"npm","package":"ibm_db","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.6.0"}]}]}],"references":[{"url":"https://github.com/ibmdb/node-ibm_db/issues/563","tags":["web"]},{"url":"https://snyk.io/vuln/SNYK-JS-IBMDB-459762","tags":["web"]},{"url":"https://www.npmjs.com/advisories/1185","tags":["web"]},{"url":"https://github.com/ibmdb/node-ibm_db/commit/526c88b5eedc605274def65405279f6708d91ce8","tags":["web"]},{"url":"https://github.com/advisories/GHSA-p77h-hv6g-fmfp"},{"url":"https://github.com/ibmdb/node-ibm_db","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-p77h-hv6g-fmfp","title":"Sensitive Data Exposure in ibm_db","description":"Versions of `ibm_db` prior to 2.6.0 are vulnerable to Sensitive Data Exposure. The package printed database credentials in plaintext in logs while in debug mode.\n\n\n## Recommendation\n\nUpgrade to version 2.6.0 or later and ensure sensitive information was not logged.","status":"published","published":"2020-09-03T20:43:16Z","modified":"2023-01-09T05:03:49Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T14:36:06.884904Z"}],"osv":[{"id":"GHSA-p77h-hv6g-fmfp","title":"Sensitive Data Exposure in ibm_db","description":"Versions of `ibm_db` prior to 2.6.0 are vulnerable to Sensitive Data Exposure. The package printed database credentials in plaintext in logs while in debug mode.\n\n\n## Recommendation\n\nUpgrade to version 2.6.0 or later and ensure sensitive information was not logged.","status":"published","published":"2020-09-03T20:43:16Z","modified":"2021-09-29T18:49:03Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:46:52.891208Z"}]}}