Skip to content
OpenAdvisories
Medium WID-SEC-2024-1650 2 CVEs

Oracle Utilities Applications: Mehrere Schwachstellen

Published Jul 16, 2024 · Updated Jul 16, 2024 · de-DE

Vendor: Oracle Product: Utilities Applications Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Utilities Applications ausnutzen, um die Verfügbarkeit zu gefährden.

Product

Oracle Utilities Applications ist eine Produktfamilie mit branchenspezifischen Lösungen für Ver- und Entsorger.

Vulnerabilities 2

  • High 7.5
    CVE-2023-52428

    Denial of Service in Connect2id Nimbus JOSE+JWT

    In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.

    druid thingsboard-tb-node thingsboard-tb-mqtt-transport tez Wolfi Maven
  • High 7.5
    CVE-2024-29857

    Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation.

    An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CP…

    druid tez bouncycastle bouncycastle Debian Ubuntu Wolfi Maven NuGet

Revision history

  1. #1

    Initiale Fassung

References