Medium WID-SEC-2023-1018 4 CVEs

Oracle Enterprise Manager: Mehrere Schwachstellen

Published Apr 18, 2023 · Updated Apr 18, 2023 · de-DE

Vendor: Oracle Product: Enterprise Manager Product: Enterprise Manager 12.4.0.0 Product: Enterprise Manager 13.3.0.1 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Enterprise Manager ausnutzen, um die Vertraulichkeit und Verfügbarkeit zu gefährden.

Product

Oracle Enterprise Manager (OEM) ist ein Set von System Management Werkzeugen von Oracle für Oracle Umgebungen. Es beinhaltet Werkzeuge zum Monitoring von Oracle Umgebung und zur Automatisierung von Datenbank- und Applikations Administration.

Vulnerabilities 4

High 8.2

CVE-2022-41966 Public exploit

XStream Denial of Service via stack overflow

XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack…

x-stream xstream com.thoughtworks.xstream:xstream libxstream-java Debian Ubuntu Maven

Dec 27, 2022
High 7.5

CVE-2021-40690

Bypass of the secureValidation property

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abus…

Apache Software Foundation Apache Santuario org.apache.santuario:xmlsec libxml-security-java Debian Ubuntu Maven

Sep 19, 2021
Medium 6.5

CVE-2022-23437 EPSS 12%

Infinite loop within Apache XercesJ xml parser

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged durat…

Apache Software Foundation Apache Xerces xerces:xercesImpl libxerces2-java Debian Ubuntu Azure Linux Maven

Jan 24, 2022
Medium 5.5

CVE-2021-36374

Apache Ant ZIP, and ZIP based, archive denial of service vulerability

When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly …

Apache Software Foundation Apache Ant javapackages-bootstrap ant Debian Ubuntu Azure Linux Alpine Maven

Jul 14, 2021

Revision history

2023-04-18 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - April 2023 - Appendix Oracle Enterprise Manager vom 2023-04-18
https://www.oracle.com/security-alerts/cpuapr2023.html#AppendixEM