Oracle Database Server: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 5

• High 7.5
  CVE-2023-52428

  Denial of Service in Connect2id Nimbus JOSE+JWT

  In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.

  druid thingsboard-tb-node thingsboard-tb-mqtt-transport tez Wolfi Maven
  Feb 11, 2024
• Medium 6.7
  CVE-2022-26345

  Uncontrolled search path element in the Intel(R) oneAPI Toolkit OpenMP before version 2022.1 may allow an authenticated…

  Feb 16, 2023
• Medium 5.9
  CVE-2023-48795 Public exploit Scanner template EPSS 94%

  Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin

  The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server…

  zot kubescape kots k3d Debian Ubuntu Azure Linux Alpine Wolfi PyPI Go crates.io
  Dec 18, 2023
• Medium 4.2
  CVE-2025-21553

  Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.25, …

  Oracle Oracle Database Server
  Jan 21, 2025
• Low 3.7
  CVE-2024-21211

  Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…

  Oracle Oracle Java SE GraalVM openjdk17 Alpine Wolfi
  Oct 15, 2024

Revision history

1. 2025-01-21 #1

   Initiale Fassung

References

• Oracle Critical Patch Update Advisory - January 2025 - Appendix Oracle Database Server vom 2025-01-21
  https://www.oracle.com/security-alerts/cpujan2025.html#AppendixDB