low 3.3

CVE-2019-2708 json

Vulnerability in the Data Store component of Oracle Berkeley DB.

published 2019-04-23 7y ago modified 2026-06-17 4mo ago also EUVD-2019-12347

cvss: 3.3; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.6%; EPSS 0.6% chance of exploitation in 30 days, percentile 49%
public exploits: 0; none known

Vulnerability in the Data Store component of Oracle Berkeley DB. Supported versions that are affected are Prior to 6.138, prior to 6.2.38 and prior to 18.1.32. Easily exploitable vulnerability allows low privileged attacker having Local Logon privilege with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Data Store. CVSS 3.0 Base Score 3.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).

Patch / fix

fixed in 1 distros 6 links 1

Oracle Corporation Oracle Berkeley DB 6.2.38, 6.138, 18.1.32

red hat suse opensuse almalinux rocky linux azure linux

libdb RHEL 8 5.3.28-40.el8
libdb-cxx RHEL 8 5.3.28-40.el8
libdb-sql RHEL 8 5.3.28-40.el8
libdb-utils RHEL 8 5.3.28-40.el8

red hat advisories RHSA-2021:1675

libdb-4_8 Linux Micro 6.0 4.8.30-7.1
libdb-4_8 SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 4.8.30-33.1
libdb-4_8 SLE Module for Basesystem 15 SP4, SLE Module for Basesystem 15 SP3, SLE Micro 5.3 +6 more 4.8.30-150000.7.6.1
libdb_java-4_8 openSUSE Leap 15.4, openSUSE Leap 15.3 4.8.30-150000.7.6.1

suse advisories SUSE-SU-2025:20067-1 SUSE-SU-2022:4289-1 SUSE-SU-2022:4214-1

db48 openSUSE Tumbleweed 4.8.30-45.1

opensuse advisories openSUSE-SU-2024:14246-1

libdb-cxx AlmaLinux 8 5.3.28-40.el8
libdb-sql AlmaLinux 8 5.3.28-40.el8

almalinux advisories ALSA-2021:1675

libdb Rocky Linux 8 5.3.28-40.el8

rocky linux advisories RLSA-2021:1675

libdb CBL-Mariner 2.0, Azure Linux 3.0 5.3.28-7

azure linux advisories AZL-34927 AZL-6630

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html advisory

Is CVE-2019-2708 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-2708 updated 2026-11-07 cvss 3.3

libdb: Denial of service in the Data Store component

Red Hat Enterprise Linux 5 db4 Red Hat Enterprise Linux 6 db4, db4-cxx, db4-tcl, db4-java, db4-utils
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux 7 libdb, libdb-cxx, libdb-sql, libdb-tcl, libdb-java, libdb-utils
affected: no fix available “Fix deferred”
Red Hat Enterprise MRG 3 libdb Red Hat JBoss Enterprise Application Platform 5 db4 Red Hat JBoss Enterprise Application Platform 6 db4 Red Hat JBoss Enterprise Web Server 2 db4 Red Hat JBoss Fuse Service Works 6 BDBJE BDBJE
affected: no fix planned “Out of support scope”
Red Hat CodeReady Linux Builder (v. 8) libdb-cxx 5.3.28-40.el8, libdb-sql 5.3.28-40.el8 Red Hat Enterprise Linux AppStream (v. 8) libdb-devel 5.3.28-40.el8, libdb-debuginfo 5.3.28-40.el8, libdb-debugsource 5.3.28-40.el8, libdb-cxx-debuginfo 5.3.28-40.el8, libdb-sql-debuginfo 5.3.28-40.el8, libdb-tcl-debuginfo 5.3.28-40.el8, +3 more Red Hat Enterprise Linux BaseOS (v. 8) libdb 5.3.28-40.el8, libdb-utils 5.3.28-40.el8
fixed: vendor fix RHSA-2021:1675

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2y ago (2024-10-02)

Exploit prediction

0.60% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	3.0	3.3	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
NVD	2.0	2.1	AV:L/AC:L/Au:N/C:N/I:N/A:P

Affected products

Oracle Corporation Oracle Berkeley DB

References

oracle.com /technetwork/security-advisory/cpuapr2019-5072813.html
patch, vendor-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/OQFKX6NKU2DCW5CTCHQSOJJDFVRVTPO6/
vendor-advisory

Sources

CVE List CVE-2019-2708
NVD CVE-2019-2708

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

json all entries feed