Oracle JD Edwards: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• Critical 9.8
  CVE-2022-42889 Public exploit EPSS 100%

  Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

  Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.String…

  Apache Software Foundation Apache Commons Text com.guicedee.services:commons-text commons-text Debian Ubuntu Maven
  Oct 13, 2022
• Medium 5.5
  CVE-2022-26336

  A carefully crafted TNEF file can cause an out of memory exception

  A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is used to read TNEF files (Microsoft Outlook and Microsoft Exchange Server). If an application uses poi-scratchpad to parse …

  Apache Software Foundation poi-scratchpad lucene-solr libapache-poi-java Ubuntu Maven
  Mar 4, 2022

Revision history

1. 2023-01-17 #1

   Initiale Fassung

References

• Oracle Critical Patch Update Advisory - January 2023 - Appendix Oracle JD Edwards vom 2023-01-17
  https://www.oracle.com/security-alerts/cpujan2023.html#AppendixJDE