Medium WID-SEC-2023-1029 2 CVEs

Oracle Supply Chain: Mehrere Schwachstellen

Published Apr 18, 2023 · Updated Apr 18, 2023 · de-DE

Vendor: Oracle Product: Supply Chain 9.3.6 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Supply Chain ausnutzen, um die Integrität und Verfügbarkeit zu gefährden.

Product

Die Oracle Supply Chain ist eine Sammlung von Applikationen für verschiedene Zwecke.

Vulnerabilities 2

High 7.5

CVE-2022-42003

Uncontrolled Resource Consumption in Jackson-databind

In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.

management-api-for-apache-cassandra-5.0 com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Wolfi Maven

Oct 2, 2022
High 7.5

CVE-2022-45143

Apache Tomcat: JsonErrorReportValve escaping

The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to s…

Apache Software Foundation Apache Tomcat tomcat9 tomcat9 Debian Ubuntu Maven

Jan 3, 2023

Revision history

2023-04-18 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - April 2023 - Appendix Oracle Supply Chain vom 2023-04-18
https://www.oracle.com/security-alerts/cpuapr2023.html#AppendixSCP