Oracle Utilities Applications: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 6

• High 7.5
  CVE-2024-34750

  Apache Tomcat: HTTP/2 excess header handling DoS

  Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 s…

  Apache Software Foundation Apache Tomcat thingsboard-tb-mqtt-transport tomcat9 Debian Ubuntu Wolfi Maven
  Jul 3, 2024
• High 7.5
  CVE-2024-38819 Public exploit Scanner template EPSS 56%

  Spring Framework Path Traversal vulnerability

  Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the p…

  libspring-java libspring-java org.springframework:spring-webmvc org.springframework:spring-webflux Debian Ubuntu Maven
  Dec 19, 2024
• High 7.3
  CVE-2024-45801

  Tampering by prototype polution in DOMPurify

  DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to…

  cure53 DOMPurify argo-workflows dompurify Debian Ubuntu Wolfi npm
  Sep 16, 2024
• Medium 5.6
  CVE-2024-35195

  Requests `Session` object does not verify requests after making first request with verify=False

  Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification r…

  psf requests katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  May 20, 2024
• Medium 5.3
  CVE-2024-29025

  Netty HttpPostRequestDecoder can OOM

  Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `HttpPostRequestDecoder` can be tricked to accumulate data. While the decoder can store items on the dis…

  netty netty druid netty Debian Ubuntu Wolfi Maven
  Mar 25, 2024
• Medium 4.4
  CVE-2024-37891

  Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3

  urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, when sending HTTP requests *without* using urllib3'…

  urllib3 urllib3 katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Wolfi PyPI
  Jun 17, 2024

Revision history

1. 2025-01-21 #1

   Initiale Fassung

References

• Oracle Critical Patch Update Advisory - January 2025 - Appendix Oracle Utilities Applications vom 2025-01-21
  https://www.oracle.com/security-alerts/cpujan2025.html#AppendixUTIL