Oracle Support Tools: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• Critical 9.8
  CVE-2022-45047 Public exploit

  Apache MINA SSHD: Java unsafe deserialization vulnerability

  Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSH…

  Apache Software Foundation Apache MINA SSHD org.apache.sshd:sshd-core org.apache.sshd:sshd-common Maven
  Nov 16, 2022
• Medium 6.5
  CVE-2021-37533

  Apache Commons Net's FTP client trusts the host from PASV response by default

  Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may l…

  Apache Software Foundation Apache Commons Net druid libcommons-net-java Debian Ubuntu Wolfi Maven
  Dec 3, 2022

Revision history

1. 2023-01-17 #1

   Initiale Fassung

References

• Oracle Critical Patch Update Advisory - January 2023 - Appendix Oracle Support Tools vom 2023-01-17
  https://www.oracle.com/security-alerts/cpujan2023.html#AppendixTOOL