Oracle PeopleSoft: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 9

• High 8.4
  CVE-2023-22014

  Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported vers…

  Oracle PeopleSoft Enterprise PT PeopleTools
  Jul 18, 2023
• High 8.3
  CVE-2022-1471 Public exploit EPSS 100%

  Remote Code execution in SnakeYAML

  SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrust…

  SnakeYaml SnakeYaml management-api-for-apache-cassandra-5.0 cassandra-reaper Debian Ubuntu Wolfi Maven
  Dec 1, 2022
• High 7.5
  CVE-2022-45061

  An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing …

  python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Azure Linux Alpine
  Nov 9, 2022
• High 7.5
  CVE-2023-22047 Public exploit Scanner template EPSS 77%

  Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported vers…

  Oracle PeopleSoft Enterprise PT PeopleTools
  Jul 18, 2023
• High 7.4
  CVE-2023-0286 Public exploit EPSS 68%

  X.400 address type confusion in X.509 GeneralName

  There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address fiel…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi PyPI crates.io
  Feb 8, 2023
• Medium 6.8
  CVE-2022-23491

  Removal of TrustCor root certificate

  Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process o…

  certifi python-certifi certifi python-certifi Debian Ubuntu PyPI
  Dec 7, 2022
• Medium 5.9
  CVE-2022-40897

  pypa/setuptools vulnerable to Regular Expression Denial of Service (ReDoS)

  Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.

  python3 python-pip setuptools setuptools Debian Ubuntu Azure Linux PyPI
  Dec 22, 2022
• Medium 5.9
  CVE-2023-1436

  Infinite recursion in Jettison leads to denial of service when creating a crafted JSONArray

  An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.

  Jettison Jettison druid libjettison-java Debian Ubuntu Wolfi Maven
  Mar 16, 2023
• Medium 4.8
  CVE-2023-23931

  Cipher.update_into can corrupt memory in pyca cryptography

  cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would a…

  pyca cryptography mitmproxy cryptography Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Feb 7, 2023

Revision history

1. 2026-08-16 #2

   PoC für CVE-2023-22047 aufgenommen

2. 2023-07-18 #1

   Initiale Fassung

References

• Oracle Critical Patch Update Advisory - July 2023 - Appendix Oracle PeopleSoft vom 2023-07-18
  https://www.oracle.com/security-alerts/cpujul2023.html#AppendixPS
• PoC CVE-2023-22047 vom 2026-08-16
  https://github.com/0xTerror/CVE-2023-22047-Oracle-PeopleSoft-LFI