Kwetsbaarheden verholpen in Oracle Analytics

Summary

Details

Vulnerabilities 16

• Critical 9.1
  CVE-2021-23926

  XMLBeans XML Entity Expansion

  The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.

  Apache Software Foundation Apache XMLBeans org.apache.xmlbeans:xmlbeans xmlbeans Debian Ubuntu Maven
  Jan 14, 2021
• High 8.1
  CVE-2024-25710

  Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file

  Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0. Users are recommended to upgrade to version 1.26.0 which fixes the issue.

  Apache Software Foundation Apache Commons Compress druid trino Debian Ubuntu Azure Linux Wolfi Maven
  Feb 19, 2024
• High 7.5
  CVE-2023-1370

  Stack exhaustion in json-smart leads to denial of service when parsing malformed JSON

  [Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any lim…

  json-smart json-smart druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  Mar 13, 2023
• High 7.5
  CVE-2023-26031

  Privilege escalation in Apache Hadoop Yarn container-executor binary on Linux systems

  Relative library resolution in linux container-executor binary in Apache Hadoop 3.3.1-3.3.4 on Linux allows local user to gain root privileges. If the YARN cluster is accepting work from remote (authenticated) users, this MAY permit remote users to gain root …

  Apache Software Foundation Apache Hadoop org.apache.hadoop:hadoop-yarn-project Maven
  Nov 16, 2023
• High 7.5
  CVE-2023-46589

  Apache Tomcat: HTTP request smuggling via malformed trailer headers

  Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that e…

  Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven
  Nov 28, 2023
• High 7.5
  CVE-2023-52428

  Denial of Service in Connect2id Nimbus JOSE+JWT

  In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.

  druid thingsboard-tb-node thingsboard-tb-mqtt-transport tez Wolfi Maven
  Feb 11, 2024
• High 7.3
  CVE-2022-21797

  Arbitrary Code Execution

  The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.

  joblib py3-joblib joblib joblib Debian Ubuntu Alpine PyPI
  Sep 26, 2022
• Medium 6.5
  CVE-2021-37533

  Apache Commons Net's FTP client trusts the host from PASV response by default

  Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may l…

  Apache Software Foundation Apache Commons Net druid libcommons-net-java Debian Ubuntu Wolfi Maven
  Dec 3, 2022
• Medium 6.5
  CVE-2022-40152 EPSS 18%

  Stack Buffer Overflow in Woodstox

  Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effec…

  x-stream Woodstox libxstream-java sonarqube-10 Debian Ubuntu Wolfi Maven
  Sep 16, 2022
• Medium 5.9
  CVE-2023-1436

  Infinite recursion in Jettison leads to denial of service when creating a crafted JSONArray

  An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.

  Jettison Jettison druid libjettison-java Debian Ubuntu Wolfi Maven
  Mar 16, 2023
• Medium 5.9
  CVE-2023-48795 Public exploit Scanner template EPSS 94%

  Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin

  The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server…

  zot kubescape kots k3d Debian Ubuntu Azure Linux Alpine Wolfi PyPI Go crates.io
  Dec 18, 2023
• Medium 5.9
  CVE-2023-49083

  cryptography vulnerable to NULL-dereference when loading PKCS7 certificates

  cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerab…

  pyca cryptography py3-cassandra-medusa mitmproxy Debian Ubuntu Azure Linux Wolfi PyPI
  Nov 29, 2023
• Medium 5.5
  CVE-2023-33202

  Bouncy Castle Denial of Service (DoS)

  Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7…

  bouncycastle bouncycastle gradle-8 gradle-stage0 Debian Ubuntu Wolfi Maven
  Nov 23, 2023
• Medium 5.5
  CVE-2024-0727

  PKCS12 Decoding crashes

  Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly. A file in …

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Jan 26, 2024
• Medium 5.4
  CVE-2024-21139

  Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics …

  Oracle Business Intelligence Enterprise Edition
  Jul 16, 2024
• Medium 4.7
  CVE-2022-0239

  Improper Restriction of XML External Entity Reference in stanfordnlp/corenlp

  corenlp is vulnerable to Improper Restriction of XML External Entity Reference

  Stanford NLP stanfordnlp/corenlp edu.stanford.nlp:stanford-corenlp Maven
  Jan 17, 2022

Revision history

1. 2024-07-17 #0

   Initiele versie

References

• Source - nvd
  https://nvd.nist.gov/vuln/detail/CVE-2021-23926
• Source - nvd
  https://nvd.nist.gov/vuln/detail/CVE-2022-21797
• Source - nvd
  https://nvd.nist.gov/vuln/detail/CVE-2023-1370
• Source - nvd
  https://nvd.nist.gov/vuln/detail/CVE-2023-1436
• Source - nvd
  https://nvd.nist.gov/vuln/detail/CVE-2023-26031
• Source - nvd
  https://nvd.nist.gov/vuln/detail/CVE-2023-33202
• Source - nvd
  https://nvd.nist.gov/vuln/detail/CVE-2023-46589
• Source - nvd
  https://nvd.nist.gov/vuln/detail/CVE-2023-48795
• Source - nvd
  https://nvd.nist.gov/vuln/detail/CVE-2023-49083
• Source - nvd
  https://nvd.nist.gov/vuln/detail/CVE-2023-52428
• Source - nvd
  https://nvd.nist.gov/vuln/detail/CVE-2024-0727
• Source - nvd
  https://nvd.nist.gov/vuln/detail/CVE-2024-21139
• Source - nvd
  https://nvd.nist.gov/vuln/detail/CVE-2024-25710
• Reference - cveprojectv5; ibm; nvd; oracle
  https://www.oracle.com/security-alerts/cpujul2024.html