Oracle Enterprise Manager: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 3

• High 7.5
  CVE-2024-29857

  Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation.

  An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CP…

  druid tez bouncycastle bouncycastle Debian Ubuntu Wolfi Maven NuGet
  May 9, 2024
• High 7.5
  CVE-2024-38819 Public exploit Scanner template EPSS 56%

  Spring Framework Path Traversal vulnerability

  Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the p…

  libspring-java libspring-java org.springframework:spring-webmvc org.springframework:spring-webflux Debian Ubuntu Maven
  Dec 19, 2024
• Medium 5.3
  CVE-2023-51074

  json-path Out-of-bounds Write vulnerability

  json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method.

  trino trino-plugin-opensearch trino-plugin-pinot trino-plugin-lakehouse Ubuntu Wolfi Maven
  Dec 27, 2023

Revision history

1. 2025-01-21 #1

   Initiale Fassung

References

• Oracle Critical Patch Update Advisory - January 2025 - Appendix Oracle Enterprise Manager vom 2025-01-21
  https://www.oracle.com/security-alerts/cpujan2025.html#AppendixEM