Oracle PeopleSoft: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 11

• Critical 9.8
  CVE-2021-3918

  Prototype Pollution in kriszyp/json-schema

  json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

  kriszyp kriszyp/json-schema node-json-schema json-schema Debian Ubuntu npm
  Nov 13, 2021
• Critical 9.8
  CVE-2022-37434 Public exploit EPSS 19%

  zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip heade…

  openjpeg2 rsync fltk gdal Debian Ubuntu Azure Linux Alpine Wolfi
  Aug 5, 2022
• High 7.5
  CVE-2022-25857

  Denial of Service (DoS)

  The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.

  management-api-for-apache-cassandra-5.0 management-api-for-apache-cassandra-5.0-compat org.yaml:snakeyaml snakeyaml Debian Ubuntu Wolfi Maven
  Aug 30, 2022
• High 7.5
  CVE-2022-27782

  libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should h…

  curl curl curl curl Debian Ubuntu Azure Linux Alpine
  Jun 1, 2022
• High 7.5
  CVE-2022-31129

  Inefficient Regular Expression Complexity in moment

  moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 par…

  moment moment mediawiki wordpress Debian Ubuntu npm NuGet
  Jul 6, 2022
• High 7.5
  CVE-2022-42003

  Uncontrolled Resource Consumption in Jackson-databind

  In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.

  management-api-for-apache-cassandra-5.0 com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Wolfi Maven
  Oct 2, 2022
• Medium 6.5
  CVE-2022-40149

  Stack Buffer Overflow in Jettison

  Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may su…

  Jettison Jettison druid libjettison-java Debian Ubuntu Wolfi Maven
  Sep 16, 2022
• Medium 6.2
  CVE-2020-10735

  A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text")…

  python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Wolfi
  Sep 9, 2022
• Medium 5.4
  CVE-2023-21844

  Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Elastic Search). Suppor…

  Oracle PeopleSoft Enterprise PT PeopleTools
  Jan 17, 2023
• Medium 5.4
  CVE-2023-21845

  Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor). The s…

  Oracle PeopleSoft Enterprise PT PeopleTools
  Jan 17, 2023
• Medium 5.3
  CVE-2023-21831

  Vulnerability in the PeopleSoft Enterprise CS Academic Advisement product of Oracle PeopleSoft (component: Advising Not…

  Oracle PeopleSoft Enterprise CS Academic Advisement
  Jan 17, 2023

Revision history

1. 2023-01-17 #1

   Initiale Fassung

References

• Oracle Critical Patch Update Advisory - January 2023 - Appendix Oracle PeopleSoft vom 2023-01-17
  https://www.oracle.com/security-alerts/cpujan2023.html#AppendixPS