High WID-SEC-2024-0120 9 CVEs

Oracle JD Edwards: Mehrere Schwachstellen

Published Jan 16, 2024 · Updated Oct 11, 2026 · Revision 2 · de-DE

Vendor: Oracle Product: JD Edwards Product: Linux Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle JD Edwards ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Die Komponenten der Oracle JDEdwards sind vollständig integrierte und komplette Lösungen geschäftlicher Anwendungen (ERP) für Unternehmen.

Vulnerabilities 9

Critical 9.8

CVE-2022-37434 Public exploit EPSS 19%

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip heade…

openjpeg2 rsync fltk gdal Debian Ubuntu Azure Linux Alpine Wolfi

Aug 5, 2022
Critical 9.8

CVE-2023-32002

The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition f…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Aug 21, 2023
High 7.5

CVE-2023-28756

Ruby Time component ReDoS issue

A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are …

ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine Wolfi RubyGems

Mar 31, 2023
Medium 6.5

CVE-2023-2650 EPSS 75%

Possible DoS translating ASN.1 object identifiers

Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with …

OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi

May 30, 2023
Medium 5.9

CVE-2023-1436

Infinite recursion in Jettison leads to denial of service when creating a crafted JSONArray

An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.

Jettison Jettison druid libjettison-java Debian Ubuntu Wolfi Maven

Mar 16, 2023
Medium 4.3

CVE-2024-20937

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics…

Oracle JD Edwards EnterpriseOne Tools

Feb 17, 2024
Low 2.7

CVE-2024-20905

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure …

Oracle JD Edwards EnterpriseOne Tools

Feb 17, 2024
Low 2.7

CVE-2024-20957

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Package Build SEC). Suppor…

Oracle JD Edwards EnterpriseOne Tools

Jan 16, 2024
Unscored —

CVE-2022-3479

A vulnerability found in nss. By this security vulnerability, nss client auth crash without a user certificate in the d…

nss nss Debian Alpine

Oct 14, 2022

Revision history

2026-10-11 #2
Neue Updates von Oracle Linux aufgenommen
2024-01-16 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - January 2024 - Appendix Oracle JD Edwards vom 2024-01-16
https://www.oracle.com/security-alerts/cpujan2024.html#AppendixJDE
Oracle Linux Security Advisory ELSA-2026-73519 vom 2026-10-09
http://linux.oracle.com/errata/ELSA-2026-73519.html