csaf_ncscnl - ncsc-2024-0291

To clipboard

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Er zijn kwetsbaarheden verholpen in Oracle Database Server.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorie\u00ebn schade:\n\n* Denial-of-Service (DoS)\n* Toegang tot gevoelige gegevens\n* Manipulatie van gegevens\n* Omzeilen van beveiligingsmaatregel",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Oracle heeft updates beschikbaar gesteld om de kwetsbaarheden te verhelpen. Zie de referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Improper Authorization",
        "title": "CWE-285"
      },
      {
        "category": "general",
        "text": "Improper Resource Shutdown or Release",
        "title": "CWE-404"
      },
      {
        "category": "general",
        "text": "Uncontrolled Recursion",
        "title": "CWE-674"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Source - nvd",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0397"
      },
      {
        "category": "external",
        "summary": "Source - nvd",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21098"
      },
      {
        "category": "external",
        "summary": "Source - nvd",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21123"
      },
      {
        "category": "external",
        "summary": "Source - nvd",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21126"
      },
      {
        "category": "external",
        "summary": "Source - nvd",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21174"
      },
      {
        "category": "external",
        "summary": "Source - nvd",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21184"
      },
      {
        "category": "external",
        "summary": "Source - nvd",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4603"
      },
      {
        "category": "external",
        "summary": "Reference - oracle",
        "url": "https://www.oracle.com/docs/tech/security-alerts/cpujul2024csaf.json"
      },
      {
        "category": "external",
        "summary": "Reference - cveprojectv5; ibm; nvd; oracle",
        "url": "https://www.oracle.com/security-alerts/cpujul2024.html"
      }
    ],
    "title": " Kwetsbaarheden verholpen in Oracle Database Server",
    "tracking": {
      "current_release_date": "2024-07-17T13:51:54.185475Z",
      "id": "NCSC-2024-0291",
      "initial_release_date": "2024-07-17T13:51:54.185475Z",
      "revision_history": [
        {
          "date": "2024-07-17T13:51:54.185475Z",
          "number": "0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-764785",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:__database___19c:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-764790",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:__database___21c:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-764843",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:__database_-_machine_learning_for_python___21c:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-1503607",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:__database_core___23.4:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-764838",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:__database_data_redaction___19c:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-764844",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:__database_data_redaction___21c:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-764839",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:__database_fleet_patching___19c:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-764845",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:__database_fleet_patching___21c:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-764787",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:__database_oml4py___21c:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-764846",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:__database_portable_clusterware___21c:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-764840",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:__database_rdbms_security___19c:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-764847",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:__database_rdbms_security___21c:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-764784",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:__database_recovery_manager___19c:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-764788",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:__database_recovery_manager___21c:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-764841",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:__database_sqlcl___19c:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-764848",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:__database_sqlcl___21c:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-764789",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:__database_workload_manager___21c:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-764842",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:_graalvm_multilingual_engine___21c:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-764783",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:_java_vm___19c:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-764786",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:_java_vm___21c:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-1503604",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:_java_vm___23.4:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-1503605",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:_multilingual_engine___23.4:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-1503606",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:_oml4py___23.4:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-266118",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:*:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-1503896",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-205254",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-205265",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.10:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-205230",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.11:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-909875",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.12:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-205250",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.13:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-909872",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.14:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-909878",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.15:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-909879",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.16:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-909880",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.17:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-909876",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.18:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-220917",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.19:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-1503891",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.2:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-816314",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.20:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-816313",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.21:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-909877",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.22:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-1503897",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.23:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-205268",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.3:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-205281",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.4:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-205295",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.5:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-205256",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.6:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-205216",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.7:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-909874",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.8:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-909873",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.9:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-1503890",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:21.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-1503893",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:21.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-220916",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:21.10:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-611586",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:21.11:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-816312",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:21.12:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-912081",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:21.13:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-1503257",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:21.14:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-1503900",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:21.2:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-205284",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:21.3:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-1503898",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:21.4:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-1503892",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:21.5:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-1503894",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:21.6:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-1503889",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:21.7:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-1503895",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:21.8:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-1503899",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:21.9:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-1503256",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:23.4:*:*:*:*:*:*:*"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "oracle"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-41881",
      "cwe": {
        "id": "CWE-674",
        "name": "Uncontrolled Recursion"
      },
      "notes": [
        {
          "category": "other",
          "text": "Uncontrolled Recursion",
          "title": "CWE-674"
        },
        {
          "category": "other",
          "text": "Improper Resource Shutdown or Release",
          "title": "CWE-404"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-266118",
          "CSAFPID-764783",
          "CSAFPID-764784",
          "CSAFPID-764785",
          "CSAFPID-764786",
          "CSAFPID-764787",
          "CSAFPID-764788",
          "CSAFPID-764789",
          "CSAFPID-764790",
          "CSAFPID-764838",
          "CSAFPID-764839",
          "CSAFPID-764840",
          "CSAFPID-764841",
          "CSAFPID-764842",
          "CSAFPID-764843",
          "CSAFPID-764844",
          "CSAFPID-764845",
          "CSAFPID-764846",
          "CSAFPID-764847",
          "CSAFPID-764848",
          "CSAFPID-1503604",
          "CSAFPID-1503605",
          "CSAFPID-1503606",
          "CSAFPID-1503607"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2022-41881",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2022/CVE-2022-41881.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-266118",
            "CSAFPID-764783",
            "CSAFPID-764784",
            "CSAFPID-764785",
            "CSAFPID-764786",
            "CSAFPID-764787",
            "CSAFPID-764788",
            "CSAFPID-764789",
            "CSAFPID-764790",
            "CSAFPID-764838",
            "CSAFPID-764839",
            "CSAFPID-764840",
            "CSAFPID-764841",
            "CSAFPID-764842",
            "CSAFPID-764843",
            "CSAFPID-764844",
            "CSAFPID-764845",
            "CSAFPID-764846",
            "CSAFPID-764847",
            "CSAFPID-764848",
            "CSAFPID-1503604",
            "CSAFPID-1503605",
            "CSAFPID-1503606",
            "CSAFPID-1503607"
          ]
        }
      ],
      "title": "CVE-2022-41881"
    },
    {
      "cve": "CVE-2024-0397",
      "product_status": {
        "known_affected": [
          "CSAFPID-266118",
          "CSAFPID-1503604",
          "CSAFPID-1503605",
          "CSAFPID-1503606",
          "CSAFPID-1503607"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-0397",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-0397.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-266118",
            "CSAFPID-1503604",
            "CSAFPID-1503605",
            "CSAFPID-1503606",
            "CSAFPID-1503607"
          ]
        }
      ],
      "title": "CVE-2024-0397"
    },
    {
      "cve": "CVE-2024-4603",
      "product_status": {
        "known_affected": [
          "CSAFPID-266118",
          "CSAFPID-1503604",
          "CSAFPID-1503605",
          "CSAFPID-1503606",
          "CSAFPID-1503607"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-4603",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-4603.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-266118",
            "CSAFPID-1503604",
            "CSAFPID-1503605",
            "CSAFPID-1503606",
            "CSAFPID-1503607"
          ]
        }
      ],
      "title": "CVE-2024-4603"
    },
    {
      "cve": "CVE-2024-21098",
      "cwe": {
        "id": "CWE-285",
        "name": "Improper Authorization"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Authorization",
          "title": "CWE-285"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-266118",
          "CSAFPID-1503604",
          "CSAFPID-1503605",
          "CSAFPID-1503606",
          "CSAFPID-1503607"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-21098",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21098.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-266118",
            "CSAFPID-1503604",
            "CSAFPID-1503605",
            "CSAFPID-1503606",
            "CSAFPID-1503607"
          ]
        }
      ],
      "title": "CVE-2024-21098"
    },
    {
      "cve": "CVE-2024-21123",
      "cwe": {
        "id": "CWE-285",
        "name": "Improper Authorization"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Authorization",
          "title": "CWE-285"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-266118",
          "CSAFPID-1503604",
          "CSAFPID-1503605",
          "CSAFPID-1503606",
          "CSAFPID-1503607"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-21123",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21123.json"
        }
      ],
      "title": "CVE-2024-21123"
    },
    {
      "cve": "CVE-2024-21126",
      "cwe": {
        "id": "CWE-404",
        "name": "Improper Resource Shutdown or Release"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Resource Shutdown or Release",
          "title": "CWE-404"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-266118",
          "CSAFPID-1503604",
          "CSAFPID-1503605",
          "CSAFPID-1503606",
          "CSAFPID-1503607"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-21126",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21126.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-266118",
            "CSAFPID-1503604",
            "CSAFPID-1503605",
            "CSAFPID-1503606",
            "CSAFPID-1503607"
          ]
        }
      ],
      "title": "CVE-2024-21126"
    },
    {
      "cve": "CVE-2024-21174",
      "product_status": {
        "known_affected": [
          "CSAFPID-266118",
          "CSAFPID-1503604",
          "CSAFPID-1503605",
          "CSAFPID-1503606",
          "CSAFPID-1503607"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-21174",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21174.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-266118",
            "CSAFPID-1503604",
            "CSAFPID-1503605",
            "CSAFPID-1503606",
            "CSAFPID-1503607"
          ]
        }
      ],
      "title": "CVE-2024-21174"
    },
    {
      "cve": "CVE-2024-21184",
      "product_status": {
        "known_affected": [
          "CSAFPID-266118",
          "CSAFPID-1503604",
          "CSAFPID-1503605",
          "CSAFPID-1503606",
          "CSAFPID-1503607"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-21184",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21184.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-266118",
            "CSAFPID-1503604",
            "CSAFPID-1503605",
            "CSAFPID-1503606",
            "CSAFPID-1503607"
          ]
        }
      ],
      "title": "CVE-2024-21184"
    }
  ]
}

cve-2022-41881

Vulnerability from cvelistv5

Published

2022-12-12 00:00

Modified

2024-08-03 12:56

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Summary

Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion. This issue is patched in version 4.1.86.Final. There is no workaround, except using a custom HaProxyMessageDecoder.

References

▼	URL	Tags
	https://github.com/netty/netty/security/advisories/GHSA-fx2c-96vj-985v
	https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html	mailing-list
	https://www.debian.org/security/2023/dsa-5316	vendor-advisory
	https://security.netapp.com/advisory/ntap-20230113-0004/

Impacted products

Vendor

Product

Version

▼

netty

Version: < 4.1.86.Final

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T12:56:38.229Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/netty/netty/security/advisories/GHSA-fx2c-96vj-985v"
          },
          {
            "name": "[debian-lts-announce] 20230111 [SECURITY] [DLA 3268-1] netty security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html"
          },
          {
            "name": "DSA-5316",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5316"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230113-0004/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "netty",
          "vendor": "netty",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.1.86.Final"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion. This issue is patched in version 4.1.86.Final. There is no workaround, except using a custom HaProxyMessageDecoder."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-13T00:00:00",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "url": "https://github.com/netty/netty/security/advisories/GHSA-fx2c-96vj-985v"
        },
        {
          "name": "[debian-lts-announce] 20230111 [SECURITY] [DLA 3268-1] netty security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html"
        },
        {
          "name": "DSA-5316",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2023/dsa-5316"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230113-0004/"
        }
      ],
      "source": {
        "advisory": "GHSA-fx2c-96vj-985v",
        "discovery": "UNKNOWN"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-41881",
    "datePublished": "2022-12-12T00:00:00",
    "dateReserved": "2022-09-30T00:00:00",
    "dateUpdated": "2024-08-03T12:56:38.229Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-21123

Vulnerability from cvelistv5

Published

2024-07-16 22:39

Modified

2024-11-05 16:36

Severity ?

2.3 (Low) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

References

▼	URL	Tags
	https://www.oracle.com/security-alerts/cpujul2024.html	vendor-advisory

Impacted products

Vendor

Product

Version

▼

Version: 19.3 <

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21123",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-17T14:53:03.011202Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-276",
                "description": "CWE-276 Incorrect Default Permissions",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-05T16:36:46.928Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:13:42.680Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Oracle Advisory",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2024.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Database - Enterprise Edition",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "lessThanOrEqual": "19.23",
              "status": "affected",
              "version": "19.3",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the Oracle Database Core component of Oracle Database Server.  Supported versions that are affected are 19.3-19.23. Easily exploitable vulnerability allows high privileged attacker having SYSDBA privilege with logon to the infrastructure where Oracle Database Core executes to compromise Oracle Database Core.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Database Core accessible data. CVSS 3.1 Base Score 2.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows high privileged attacker having SYSDBA privilege with logon to the infrastructure where Oracle Database Core executes to compromise Oracle Database Core.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Database Core accessible data.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-16T22:39:45.449Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2024.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2024-21123",
    "datePublished": "2024-07-16T22:39:45.449Z",
    "dateReserved": "2023-12-07T22:28:10.681Z",
    "dateUpdated": "2024-11-05T16:36:46.928Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-21126

Vulnerability from cvelistv5

Published

2024-07-16 22:39

Modified

2024-08-29 19:26

Severity ?

5.8 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

References

▼	URL	Tags
	https://www.oracle.com/security-alerts/cpujul2024.html	vendor-advisory

Impacted products

Vendor

Product

Version

▼

Version: 19.3 <
Version: 21.3 <

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:13:42.700Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Oracle Advisory",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2024.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:oracle:database:-:*:*:*:enterprise:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "database",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "21.14",
                "status": "affected",
                "version": "21.3",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "19.23",
                "status": "affected",
                "version": "19.3",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21126",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-05T17:45:10.937095Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-29T19:26:29.803Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Database - Enterprise Edition",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "lessThanOrEqual": "19.23",
              "status": "affected",
              "version": "19.3",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "21.14",
              "status": "affected",
              "version": "21.3",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the Oracle Database Portable Clusterware component of Oracle Database Server.  Supported versions that are affected are 19.3-19.23 and  21.3-21.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via DNS to compromise Oracle Database Portable Clusterware.  While the vulnerability is in Oracle Database Portable Clusterware, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Database Portable Clusterware. CVSS 3.1 Base Score 5.8 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via DNS to compromise Oracle Database Portable Clusterware.  While the vulnerability is in Oracle Database Portable Clusterware, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Database Portable Clusterware.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-16T22:39:52.158Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2024.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2024-21126",
    "datePublished": "2024-07-16T22:39:52.158Z",
    "dateReserved": "2023-12-07T22:28:10.681Z",
    "dateUpdated": "2024-08-29T19:26:29.803Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-21098

Vulnerability from cvelistv5

Published

2024-04-16 21:26

Modified

2024-11-15 19:11

Severity ?

3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

References

▼	URL	Tags
	https://www.oracle.com/security-alerts/cpuapr2024.html	vendor-advisory

Impacted products

Vendor

Product

Version

▼

GraalVM

Version: Oracle GraalVM for JDK:17.0.10
Version: Oracle GraalVM for JDK:21.0.2
Version: Oracle GraalVM for JDK:22
Version: Oracle GraalVM Enterprise Edition:20.3.13
Version: Oracle GraalVM Enterprise Edition:21.3.9
    cpe:2.3:a:oracle:graalvm_for_jdk:17.0.10:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:graalvm_for_jdk:21.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:graalvm_for_jdk:22:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:graalvm:20.3.13:*:*:*:enterprise:*:*:*
    cpe:2.3:a:oracle:graalvm:21.3.9:*:*:*:enterprise:*:*:*

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21098",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-15T19:21:01.904883Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-15T19:11:30.338Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:13:42.661Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Oracle Advisory",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2024.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:oracle:graalvm_for_jdk:17.0.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:graalvm_for_jdk:21.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:graalvm_for_jdk:22:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:graalvm:20.3.13:*:*:*:enterprise:*:*:*",
            "cpe:2.3:a:oracle:graalvm:21.3.9:*:*:*:enterprise:*:*:*"
          ],
          "product": "GraalVM",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Oracle GraalVM for JDK:17.0.10"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM for JDK:21.0.2"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM for JDK:22"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.13"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.3.9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Compiler).  Supported versions that are affected are Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and  21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. CVSS 3.1 Base Score 3.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-16T21:26:31.636Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2024.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2024-21098",
    "datePublished": "2024-04-16T21:26:31.636Z",
    "dateReserved": "2023-12-07T22:28:10.675Z",
    "dateUpdated": "2024-11-15T19:11:30.338Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-4603

Vulnerability from cvelistv5

Published

2024-05-16 15:21

Modified

2024-10-14 14:56

Severity ?

Summary

Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the functions EVP_PKEY_param_check() or EVP_PKEY_public_check() to check a DSA public key or DSA parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform various checks on DSA parameters. Some of those computations take a long time if the modulus (`p` parameter) is too large. Trying to use a very large modulus is slow and OpenSSL will not allow using public keys with a modulus which is over 10,000 bits in length for signature verification. However the key and parameter check functions do not limit the modulus size when performing the checks. An application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. These functions are not called by OpenSSL itself on untrusted DSA keys so only applications that directly call these functions may be vulnerable. Also vulnerable are the OpenSSL pkey and pkeyparam command line applications when using the `-check` option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.

References

▼	URL	Tags
	https://www.openssl.org/news/secadv/20240516.txt	vendor-advisory
	https://github.com/openssl/openssl/commit/3559e868e58005d15c6013a0c1fd832e51c73397	patch
	https://github.com/openssl/openssl/commit/9c39b3858091c152f52513c066ff2c5a47969f0d	patch
	https://github.com/openssl/openssl/commit/da343d0605c826ef197aceedc67e8e04f065f740	patch
	https://github.com/openssl/openssl/commit/53ea06486d296b890d565fb971b2764fcd826e7e	patch

Impacted products

Vendor

Product

Version

▼

OpenSSL

Version: 3.0.0   ≤
Version: 3.1.0   ≤
Version: 3.2.0   ≤
Version: 3.3.0   ≤

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T20:47:41.528Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "OpenSSL Advisory",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.openssl.org/news/secadv/20240516.txt"
          },
          {
            "name": "3.0.14 git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/openssl/openssl/commit/3559e868e58005d15c6013a0c1fd832e51c73397"
          },
          {
            "name": "3.1.6 git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/openssl/openssl/commit/9c39b3858091c152f52513c066ff2c5a47969f0d"
          },
          {
            "name": "3.2.2 git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/openssl/openssl/commit/da343d0605c826ef197aceedc67e8e04f065f740"
          },
          {
            "name": "3.3.1 git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/openssl/openssl/commit/53ea06486d296b890d565fb971b2764fcd826e7e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/05/16/2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240621-0001/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "openssl",
            "vendor": "openssl",
            "versions": [
              {
                "lessThan": "3.0.14",
                "status": "affected",
                "version": "3.0.0",
                "versionType": "semver"
              },
              {
                "lessThan": "3.1.6",
                "status": "affected",
                "version": "3.1.0",
                "versionType": "semver"
              },
              {
                "lessThan": "3.2.2",
                "status": "affected",
                "version": "3.2.0",
                "versionType": "semver"
              },
              {
                "lessThan": "3.3.1",
                "status": "affected",
                "version": "3.3.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-4603",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-16T18:27:25.638098Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-834",
                "description": "CWE-834 Excessive Iteration",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-13T15:11:57.009Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "lessThan": "3.0.14",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.1.6",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.2.2",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.3.1",
              "status": "affected",
              "version": "3.3.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "OSS-Fuzz"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Tomas Mraz"
        }
      ],
      "datePublic": "2024-05-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Issue summary: Checking excessively long DSA keys or parameters may be very\u003cbr\u003eslow.\u003cbr\u003e\u003cbr\u003eImpact summary: Applications that use the functions EVP_PKEY_param_check()\u003cbr\u003eor EVP_PKEY_public_check() to check a DSA public key or DSA parameters may\u003cbr\u003eexperience long delays. Where the key or parameters that are being checked\u003cbr\u003ehave been obtained from an untrusted source this may lead to a Denial of\u003cbr\u003eService.\u003cbr\u003e\u003cbr\u003eThe functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform\u003cbr\u003evarious checks on DSA parameters. Some of those computations take a long time\u003cbr\u003eif the modulus (`p` parameter) is too large.\u003cbr\u003e\u003cbr\u003eTrying to use a very large modulus is slow and OpenSSL will not allow using\u003cbr\u003epublic keys with a modulus which is over 10,000 bits in length for signature\u003cbr\u003everification. However the key and parameter check functions do not limit\u003cbr\u003ethe modulus size when performing the checks.\u003cbr\u003e\u003cbr\u003eAn application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check()\u003cbr\u003eand supplies a key or parameters obtained from an untrusted source could be\u003cbr\u003evulnerable to a Denial of Service attack.\u003cbr\u003e\u003cbr\u003eThese functions are not called by OpenSSL itself on untrusted DSA keys so\u003cbr\u003eonly applications that directly call these functions may be vulnerable.\u003cbr\u003e\u003cbr\u003eAlso vulnerable are the OpenSSL pkey and pkeyparam command line applications\u003cbr\u003ewhen using the `-check` option.\u003cbr\u003e\u003cbr\u003eThe OpenSSL SSL/TLS implementation is not affected by this issue.\u003cbr\u003e\u003cbr\u003eThe OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue."
            }
          ],
          "value": "Issue summary: Checking excessively long DSA keys or parameters may be very\nslow.\n\nImpact summary: Applications that use the functions EVP_PKEY_param_check()\nor EVP_PKEY_public_check() to check a DSA public key or DSA parameters may\nexperience long delays. Where the key or parameters that are being checked\nhave been obtained from an untrusted source this may lead to a Denial of\nService.\n\nThe functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform\nvarious checks on DSA parameters. Some of those computations take a long time\nif the modulus (`p` parameter) is too large.\n\nTrying to use a very large modulus is slow and OpenSSL will not allow using\npublic keys with a modulus which is over 10,000 bits in length for signature\nverification. However the key and parameter check functions do not limit\nthe modulus size when performing the checks.\n\nAn application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check()\nand supplies a key or parameters obtained from an untrusted source could be\nvulnerable to a Denial of Service attack.\n\nThese functions are not called by OpenSSL itself on untrusted DSA keys so\nonly applications that directly call these functions may be vulnerable.\n\nAlso vulnerable are the OpenSSL pkey and pkeyparam command line applications\nwhen using the `-check` option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue."
        }
      ],
      "metrics": [
        {
          "format": "other",
          "other": {
            "content": {
              "text": "Low"
            },
            "type": "https://www.openssl.org/policies/secpolicy.html"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-606",
              "description": "CWE-606 Unchecked Input for Loop Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-14T14:56:01.784Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "name": "OpenSSL Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.openssl.org/news/secadv/20240516.txt"
        },
        {
          "name": "3.0.14 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/3559e868e58005d15c6013a0c1fd832e51c73397"
        },
        {
          "name": "3.1.6 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/9c39b3858091c152f52513c066ff2c5a47969f0d"
        },
        {
          "name": "3.2.2 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/da343d0605c826ef197aceedc67e8e04f065f740"
        },
        {
          "name": "3.3.1 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/53ea06486d296b890d565fb971b2764fcd826e7e"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Excessive time spent checking DSA keys and parameters",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2024-4603",
    "datePublished": "2024-05-16T15:21:20.050Z",
    "dateReserved": "2024-05-07T11:44:02.196Z",
    "dateUpdated": "2024-10-14T14:56:01.784Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-21184

Vulnerability from cvelistv5

Published

2024-07-16 22:40

Modified

2024-08-01 22:13

Severity ?

7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

▼	URL	Tags
	https://www.oracle.com/security-alerts/cpujul2024.html	vendor-advisory

Impacted products

Vendor

Product

Version

▼

Version: 19.3 <

Show details on NVD website

Python Software Foundation

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:oracle:database_server:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "database_server",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "19.3",
                "status": "affected",
                "version": "19.23",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21184",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-18T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-250",
                "description": "CWE-250 Execution with Unnecessary Privileges",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-19T03:55:40.559Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:13:42.829Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Oracle Advisory",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2024.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Database - Enterprise Edition",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "lessThanOrEqual": "19.23",
              "status": "affected",
              "version": "19.3",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the Oracle Database RDBMS Security component of Oracle Database Server.  Supported versions that are affected are 19.3-19.23. Easily exploitable vulnerability allows high privileged attacker having Execute on SYS.XS_DIAG privilege with network access via Oracle Net to compromise Oracle Database RDBMS Security.  Successful attacks of this vulnerability can result in takeover of Oracle Database RDBMS Security. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows high privileged attacker having Execute on SYS.XS_DIAG privilege with network access via Oracle Net to compromise Oracle Database RDBMS Security.  Successful attacks of this vulnerability can result in takeover of Oracle Database RDBMS Security.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-16T22:40:11.681Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2024.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2024-21184",
    "datePublished": "2024-07-16T22:40:11.681Z",
    "dateReserved": "2023-12-07T22:28:10.688Z",
    "dateUpdated": "2024-08-01T22:13:42.829Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-0397

Vulnerability from cvelistv5

Published

2024-06-17 15:09

Modified

2024-09-17 18:24

Severity ?

7.4 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

Summary

A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a certificate directory configured. This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.

References

▼	URL	Tags
	https://github.com/python/cpython/issues/114572	issue-tracking
	https://github.com/python/cpython/pull/114573	patch
	https://mail.python.org/archives/list/security-announce@python.org/thread/BMAK5BCGKYWNJOACVUSLUF6SFGBIM4VP/	vendor-advisory
	https://github.com/python/cpython/commit/01c37f1d0714f5822d34063ca7180b595abf589d	patch
	https://github.com/python/cpython/commit/29c97287d205bf2f410f4895ebce3f43b5160524	patch
	https://github.com/python/cpython/commit/37324b421b72b7bc9934e27aba85d48d4773002e	patch
	https://github.com/python/cpython/commit/542f3272f56f31ed04e74c40635a913fbc12d286	patch
	https://github.com/python/cpython/commit/b228655c227b2ca298a8ffac44d14ce3d22f6faa	patch
	https://github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766ab	patch
	http://www.openwall.com/lists/oss-security/2024/06/17/2

Impacted products

Vendor

Product

Version

▼

CPython

Version: 0
Version: 3.9.0
Version: 3.10.0
Version: 3.11.0
Version: 3.12.0
Version: 3.13.0a1

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:python_software_foundation:cpython:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "cpython",
            "vendor": "python_software_foundation",
            "versions": [
              {
                "lessThan": "3.8.20",
                "status": "affected",
                "version": "0",
                "versionType": "python"
              },
              {
                "lessThan": "3.9.20",
                "status": "affected",
                "version": "3.9.0",
                "versionType": "python"
              },
              {
                "lessThan": "3.10.14",
                "status": "affected",
                "version": "3.10.0",
                "versionType": "python"
              },
              {
                "lessThan": "3.11.9",
                "status": "affected",
                "version": "3.11.0",
                "versionType": "python"
              },
              {
                "lessThan": "3.12.3",
                "status": "affected",
                "version": "3.12.0",
                "versionType": "python"
              },
              {
                "lessThan": "3.13.0a5",
                "status": "affected",
                "version": "3.13.0a1",
                "versionType": "python"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-0397",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-20T15:52:27.499743Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-362",
                "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-17T18:24:43.948Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T18:04:49.771Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "issue-tracking",
              "x_transferred"
            ],
            "url": "https://github.com/python/cpython/issues/114572"
          },
          {
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/python/cpython/pull/114573"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/BMAK5BCGKYWNJOACVUSLUF6SFGBIM4VP/"
          },
          {
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/python/cpython/commit/01c37f1d0714f5822d34063ca7180b595abf589d"
          },
          {
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/python/cpython/commit/29c97287d205bf2f410f4895ebce3f43b5160524"
          },
          {
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/python/cpython/commit/37324b421b72b7bc9934e27aba85d48d4773002e"
          },
          {
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/python/cpython/commit/542f3272f56f31ed04e74c40635a913fbc12d286"
          },
          {
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/python/cpython/commit/b228655c227b2ca298a8ffac44d14ce3d22f6faa"
          },
          {
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766ab"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/06/17/2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.8.20",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThan": "3.9.20",
              "status": "affected",
              "version": "3.9.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.10.14",
              "status": "affected",
              "version": "3.10.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.11.9",
              "status": "affected",
              "version": "3.11.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.12.3",
              "status": "affected",
              "version": "3.12.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.13.0a5",
              "status": "affected",
              "version": "3.13.0a1",
              "versionType": "python"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A defect was discovered in the Python \u201cssl\u201d module where there is a memory\nrace condition with the ssl.SSLContext methods \u201ccert_store_stats()\u201d and\n\u201cget_ca_certs()\u201d. The race condition can be triggered if the methods are\ncalled at the same time as certificates are loaded into the SSLContext,\nsuch as during the TLS handshake with a certificate directory configured.\nThis issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5."
            }
          ],
          "value": "A defect was discovered in the Python \u201cssl\u201d module where there is a memory\nrace condition with the ssl.SSLContext methods \u201ccert_store_stats()\u201d and\n\u201cget_ca_certs()\u201d. The race condition can be triggered if the methods are\ncalled at the same time as certificates are loaded into the SSLContext,\nsuch as during the TLS handshake with a certificate directory configured.\nThis issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-07T02:44:08.540Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/114572"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/114573"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/BMAK5BCGKYWNJOACVUSLUF6SFGBIM4VP/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/01c37f1d0714f5822d34063ca7180b595abf589d"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/29c97287d205bf2f410f4895ebce3f43b5160524"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/37324b421b72b7bc9934e27aba85d48d4773002e"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/542f3272f56f31ed04e74c40635a913fbc12d286"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/b228655c227b2ca298a8ffac44d14ce3d22f6faa"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766ab"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2024/06/17/2"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Memory race condition in ssl.SSLContext certificate store methods",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2024-0397",
    "datePublished": "2024-06-17T15:09:40.896Z",
    "dateReserved": "2024-01-10T14:05:31.635Z",
    "dateUpdated": "2024-09-17T18:24:43.948Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-21174

Vulnerability from cvelistv5

Published

2024-07-16 22:40

Modified

2024-12-03 19:45

Severity ?

3.1 (Low) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

References

▼	URL	Tags
	https://www.oracle.com/security-alerts/cpujul2024.html	vendor-advisory

Impacted products

Vendor

Product

Version

▼

Version: 19.3 <
Version: 21.3 <
Version: 23.4

Show details on NVD website