Oracle Retail Applications: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 3

• Medium 6.3
  CVE-2025-68161

  Apache Log4j Core: Missing TLS hostname verification in Socket appender

  The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-att…

  Apache Software Foundation Apache Log4j Core airflow-3 celeborn-0.6 Debian Ubuntu Wolfi Maven
  Dec 18, 2025
• Medium 6.0
  CVE-2025-7962

  Jakarta Mail vulnerable to SMTP Injection

  In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages.

  Eclipse Foundation Jakarta Mail thingsboard-tb-node apache-nifi Debian Ubuntu Wolfi Maven
  Jul 21, 2025
• Medium 5.3
  CVE-2025-48924 Public exploit

  Apache Commons Lang, Apache Commons Lang: ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs

  Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0. The methods ClassUtils.getClass(...) can thr…

  Apache Software Foundation Apache Commons Lang druid thingsboard-tb-node Debian Ubuntu Azure Linux Wolfi Maven
  Jul 11, 2025

Revision history

1. 2026-04-21 #1

   Initiale Fassung

References

• Oracle Critical Patch Update Advisory - April 2026 - Appendix Oracle Retail Applications vom 2026-04-21
  https://www.oracle.com/security-alerts/cpuapr2026.html#AppendixRAPP