Medium WID-SEC-2024-0105 4 CVEs

Oracle Construction and Engineering: Mehrere Schwachstellen

Published Jan 16, 2024 · Updated Jan 16, 2024 · de-DE

Vendor: Oracle Product: Construction and Engineering Product: Construction and Engineering <= 19.12.16 Product: Construction and Engineering <= 19.12.22 Product: Construction and Engineering <= 20.12.16 Product: Construction and Engineering <= 20.12.20 Product: Construction and Engineering <= 21.12.17 Product: Construction and Engineering <= 22.12.10 Product: Construction and Engineering <= 22.12.11 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Construction and Engineering ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Construction and Engineering ist eine Sammlung von Werkzeugen zur Unterstützung von Bau- und Ingenieurbüros. Sie umfasst u. a. Projektmanagement-Lösungen zur Verwaltung von Projekte, zur Schaffung von Transparenz, zur Zusammenarbeit und zur Verwaltung von Änderungen.

Vulnerabilities 4

Critical 9.1

CVE-2023-44981

Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication

Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper (quorum.auth.enableSasl=true), the authorization is done by verifying that the instance part in SASL authentication …

Apache Software Foundation Apache ZooKeeper trino zookeeper Debian Ubuntu Wolfi Maven

Oct 11, 2023
High 7.5

CVE-2023-5072

DoS Vulnerability in JSON-Java

Denial of Service in JSON-Java versions up to and including 20230618. A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.

https://github.com/stleary/JSON-java openjdk17 openjdk21 libjettison-java Debian Ubuntu Alpine Maven

Oct 12, 2023
Medium 5.5

CVE-2023-2976

Use of temporary directory for file creation in `FileBackedOutputStream` in Guava

Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary di…

Google Guava celeborn-0.6 trino-plugin-clickhouse Debian Ubuntu Azure Linux Wolfi Maven

Jun 14, 2023
Medium 5.5

CVE-2023-42503

Apache Commons Compress: Denial of service via CPU consumption for malformed TAR file

Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apache Commons Compress: from 1.22 before 1.24.0. Users are recommended to upgrade to version 1.24.0, which fixes the issue…

Apache Software Foundation Apache Commons Compress trino trino-plugin-opensearch Debian Ubuntu Wolfi Maven

Sep 14, 2023

Revision history

2024-01-16 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - January 2024 - Appendix Oracle Construction and Engineering vom 2024-01-16
https://www.oracle.com/security-alerts/cpujan2024.html#AppendixPVA