Oracle Health Sciences Applications: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• High 7.5
  CVE-2022-23457 Public exploit

  Path Traversal in ESAPI

  ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the test…

  OWASP ESAPI org.owasp.esapi:esapi org.owasp.esapi:esapi libowasp-esapi-java Debian Ubuntu Maven
  Apr 25, 2022
• High 7.5
  CVE-2022-42003

  Uncontrolled Resource Consumption in Jackson-databind

  In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.

  management-api-for-apache-cassandra-5.0 com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Wolfi Maven
  Oct 2, 2022

Revision history

1. 2023-01-17 #1

   Initiale Fassung

References

• Oracle Critical Patch Update Advisory - January 2023 - Appendix Oracle Health Sciences Applications vom 2023-01-17
  https://www.oracle.com/security-alerts/cpujan2023.html#AppendixHCAR