Oracle Insurance Applications: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 3

• Medium 6.5
  CVE-2021-37533

  Apache Commons Net's FTP client trusts the host from PASV response by default

  Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may l…

  Apache Software Foundation Apache Commons Net druid libcommons-net-java Debian Ubuntu Wolfi Maven
  Dec 3, 2022
• Medium 6.5
  CVE-2023-20863

  Spring Framework vulnerable to denial of service

  In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.

  libspring-java libspring-java org.springframework:spring-expression Debian Ubuntu Maven
  Apr 13, 2023
• Medium 5.9
  CVE-2023-1436

  Infinite recursion in Jettison leads to denial of service when creating a crafted JSONArray

  An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.

  Jettison Jettison druid libjettison-java Debian Ubuntu Wolfi Maven
  Mar 16, 2023

Revision history

1. 2023-07-18 #1

   Initiale Fassung

References

• Oracle Critical Patch Update Advisory - July 2023 - Appendix Oracle Insurance Applications vom 2023-07-18
  https://www.oracle.com/security-alerts/cpujul2023.html#AppendixINSU