Medium WID-SEC-2024-0885 7 CVEs

Oracle Database Server: Mehrere Schwachstellen

Published Apr 16, 2024 · Updated Apr 16, 2024 · de-DE

Vendor: Oracle Product: Database Server Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Oracle Database Server ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Die Oracle Datenbank ist ein weit verbreitetes relationales Datenbanksystem.

Vulnerabilities 7

High 7.5

CVE-2023-5072

DoS Vulnerability in JSON-Java

Denial of Service in JSON-Java versions up to and including 20230618. A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.

https://github.com/stleary/JSON-java openjdk17 openjdk21 libjettison-java Debian Ubuntu Alpine Maven

Oct 12, 2023
Medium 5.9

CVE-2023-48795 Public exploit Scanner template EPSS 94%

Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server…

zot kubescape kots k3d Debian Ubuntu Azure Linux Alpine Wolfi PyPI Go crates.io

Dec 18, 2023
Medium 5.3

CVE-2024-21093

Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.22 a…

Oracle Database - Enterprise Edition

Apr 16, 2024
Medium 4.9

CVE-2024-21058

Vulnerability in the Unified Audit component of Oracle Database Server. Supported versions that are affected are 19.3-1…

Oracle Database - Enterprise Edition

Apr 16, 2024
Medium 4.2

CVE-2024-21066

Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.22 and…

Oracle Database - Enterprise Edition

Apr 16, 2024
Low 2.4

CVE-2024-20995

Vulnerability in the Oracle Database Sharding component of Oracle Database Server. Supported versions that are affected…

Oracle Database - Enterprise Edition

Apr 16, 2024
Unscored —

CVE-2023-36632

The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maximum…

python-py Azure Linux

Jun 25, 2023

Revision history

2024-04-16 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - April 2024 - Appendix Oracle Database Server vom 2024-04-16
https://www.oracle.com/security-alerts/cpuapr2024.html#AppendixDB