Oracle Enterprise Manager: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 3

• Critical 9.8
  CVE-2022-42889 Public exploit EPSS 100%

  Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

  Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.String…

  Apache Software Foundation Apache Commons Text com.guicedee.services:commons-text commons-text Debian Ubuntu Maven
  Oct 13, 2022
• High 7.7
  CVE-2022-25647 EPSS 12%

  Deserialization of Untrusted Data

  The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.

  openjdk11 openjdk17 trino openjdk15 Debian Ubuntu Alpine Wolfi Maven
  May 1, 2022
• Unscored —
  CVE-2022-31813 Public exploit

  mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism

  Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  Jun 8, 2022

Revision history

1. 2023-01-17 #1

   Initiale Fassung

References

• Oracle Critical Patch Update Advisory - January 2023 - Appendix Oracle Enterprise Manager vom 2023-01-17
  https://www.oracle.com/security-alerts/cpujan2023.html#AppendixEM