Oracle Supply Chain: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 6

• High 8.8
  CVE-2024-20953 Exploited

  Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export). The supported version that is…

  Oracle Agile PLM Framework
  Feb 17, 2024

  KEV Feb 24, 2025
• High 7.5
  CVE-2023-44487 Exploited Public exploit EPSS 100%

  HTTP/2 Stream Cancellation Attack

  The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

  nodejs golang go kubescape Debian Ubuntu Azure Linux Alpine Wolfi Maven Go SwiftURL
  Oct 10, 2023

  KEV Oct 10, 2023
• High 7.5
  CVE-2023-34624

  htmlcleaner vulnerable to stack exhaustion

  An issue was discovered htmlcleaner thru = 2.28 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.

  net.sourceforge.htmlcleaner:htmlcleaner libhtmlcleaner-java libhtmlcleaner-java Debian Ubuntu Maven
  Jun 14, 2023
• High 7.3
  CVE-2024-20956

  Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: I…

  Oracle Agile Product Lifecycle Management for Process
  Feb 17, 2024
• Medium 6.1
  CVE-2024-20942

  Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle Supply Chain (component: LOV). …

  Oracle Complex Maintenance, Repair, and Overhaul
  Jan 16, 2024
• Medium 5.5
  CVE-2023-2976

  Use of temporary directory for file creation in `FileBackedOutputStream` in Guava

  Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary di…

  Google Guava celeborn-0.6 trino-plugin-clickhouse Debian Ubuntu Azure Linux Wolfi Maven
  Jun 14, 2023

Revision history

1. 2025-02-24 #3

   CVE-2024-20953 wird ausgenutzt

2. 2024-03-07 #2

   Neue Updates von Ubuntu aufgenommen

3. 2024-01-16 #1

   Initiale Fassung

References

• Oracle Critical Patch Update Advisory - January 2024 - Appendix Oracle Supply Chain vom 2024-01-16
  https://www.oracle.com/security-alerts/cpujan2024.html#AppendixSCP
• Ubuntu Security Notice USN-6683-1 vom 2024-03-07
  https://ubuntu.com/security/notices/USN-6683-1
• CISA Known Exploited Vulnerabilities Catalog vom 2025-02-24
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog