Oracle Commerce: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 9

• Critical 9.8
  CVE-2022-46337

  Apache Derby: LDAP injection vulnerability in authenticator

  A cleverly devised username might bypass LDAP authentication checks. In LDAP-authenticated Derby installations, this could let an attacker fill up the disk by creating junk Derby databases. In LDAP-authenticated Derby installations, this could also allow the …

  Apache Software Foundation Apache Derby druid spark-4.0-scala-2.13 Debian Ubuntu Wolfi Maven
  Nov 20, 2023
• High 7.5
  CVE-2024-34750

  Apache Tomcat: HTTP/2 excess header handling DoS

  Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 s…

  Apache Software Foundation Apache Tomcat thingsboard-tb-mqtt-transport tomcat9 Debian Ubuntu Wolfi Maven
  Jul 3, 2024
• Medium 6.5
  CVE-2023-20863

  Spring Framework vulnerable to denial of service

  In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.

  libspring-java libspring-java org.springframework:spring-expression Debian Ubuntu Maven
  Apr 13, 2023
• Medium 5.9
  CVE-2019-10172 Public exploit EPSS 17%

  Improper Restriction of XML External Entity Reference in jackson-mapper-asl

  A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes.

  Red Hat jackson-mapper-asl tez spark-4.0-scala-2.13 Debian Ubuntu Wolfi Maven
  Nov 18, 2019
• Medium 5.5
  CVE-2023-2976

  Use of temporary directory for file creation in `FileBackedOutputStream` in Guava

  Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary di…

  Google Guava celeborn-0.6 trino-plugin-clickhouse Debian Ubuntu Azure Linux Wolfi Maven
  Jun 14, 2023
• Medium 5.5
  CVE-2024-26308 Public exploit

  Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file

  Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26. Users are recommended to upgrade to version 1.26, which fixes the issue.

  Apache Software Foundation Apache Commons Compress druid trino Debian Ubuntu Wolfi Maven
  Feb 19, 2024
• Medium 5.3
  CVE-2020-13956

  Cross-site scripting in Apache HttpClient

  Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

  druid trino trino-plugin-opensearch trino-plugin-pinot Debian Ubuntu Wolfi Maven
  Dec 2, 2020
• Medium 5.3
  CVE-2021-28170

  Improper Input Validation in Jakarta Expression Language

  In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.

  The Eclipse Foundation Jakarta Expression Language Implementation org.glassfish:jakarta.el com.sun.el:el-ri Debian Ubuntu Maven
  May 26, 2021
• Low 3.3
  CVE-2021-23358 Public exploit

  Arbitrary Code Injection

  The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

  js-jquery underscore underscore underscore Debian Ubuntu Azure Linux npm
  Mar 29, 2021

Revision history

1. 2024-10-15 #1

   Initiale Fassung

References

• Oracle Critical Patch Update Advisory - October 2024 - Appendix Oracle Commerce vom 2024-10-15
  https://www.oracle.com/security-alerts/cpuoct2024.html#AppendixOCOM