Accessibility Options |  Sitemap |  Contact Us
   
 
 
 
HOME space ABOUTCERTIn space KNOWLEDGEBASE space TRAINING space ADVISORIES space VULNOTES space space Facebook space x space insta space pixs
ITUWSTA
WLine
DigitalIndia
WLine
csk
WLine
Full Member FIRST
Line
Operational Member TFCSIRT
Line
Accredited Member APCERT
Line
Global Research Partner APWG
Line
Associate Partner Charter
Line
 Directions by CERT-In under  Section 70B, Information  Technology Act 2000
WLine
 Guidelines on Information  Security Practices for  Government Entities
WLine
 Technical Guidelines on NEW  SOFTWARE BILL OF MATERIALS  (SBOM)
About CERT-in
Line
point point Client's /Citizen's Charter
Line
point point Roles & Functions
Line
point point Advisory Committee
Line
point point Act/Rules/Regulations
Line
point point Internal Complaint Committee         (ICC) 
Line
point point RFC2350 
line
point point Press  
Line
point point Tender 
Line
point point Subscribe Mailing List
Line
point point Contact Us
Line
Line
Reporting
point
 Incident Reporting
point
Line
point
 Vulnerability Reporting
point
Line
point
 Feedback
point
Line
KnowledgeBase
Line
point Point Guidelines
Line
point Point Presentations
Line
point Point White Papers 
Line
point Point Annual Report 
Line
Line
Line
line
Line
Advisories
Line
VulnerabilityNotes
Line
RelatedLinks
Line
point Point World CERTs
Line
point point Antivirus Resources
line
point point FAQ
line
line
Line
Line
line
line
line
line
line
line
line
line
line
line
line
line
line
line
line
line
line
line
line
line
line
line
spacer
Home - AdvisoriesPrint
point

CERT-In Advisory CIAD-2024-0036

Multiple Vulnerabilities in Oracle Products

Original Issue Date: July 22, 2024

Severity Rating: High

Software Affected

  • Oracle NoSQL Database, versions 1.4, 1.5, prior to 19.5.42, prior to 20.3.40, prior to 21.2.27, prior to 22.3.46, prior to 23.3.32
  • Oracle Outside In Technology, version 8.5.7
  • Oracle Reports Developer, versions 12.2.1.4.0, 12.2.1.19.0
  • Oracle REST Data Services, versions prior to 23.3.1, prior to 24.1.0
  • Oracle Retail Assortment Planning, versions 15.0.3, 16.0.3
  • Oracle Retail Financial Integration, versions 14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1
  • Oracle Retail Integration Bus, versions 14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1
  • Oracle Retail Predictive Application Server, versions 15.0.3, 16.0.3
  • Oracle Retail Xstore Office, versions 19.0.5, 20.0.3, 20.0.4, 22.0.0, 23.0.1
  • Oracle Service Bus, version 12.2.1.4.0
  • Oracle Solaris, version 11
  • Oracle TimesTen In-Memory Database, versions 22.1.1.1.0-22.1.1.24.0
  • Oracle Unified Directory, version 12.2.1.4.0
  • Oracle Utilities Application Framework, versions 4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0, 4.5.0.0.0, 4.5.0.1.1-4.5.0.1.3, 24.1.0.0.0, 24.2.0.0.0
  • Oracle VM VirtualBox, versions prior to 7.0.20
  • Oracle WebCenter Content, version 12.2.1.4.0
  • Oracle WebCenter Portal, version 12.2.1.4.0
  • Oracle WebCenter Sites, version 12.2.1.4.0
  • Oracle WebLogic Server, versions 12.2.1.4.0, 14.1.1.0.0
  • Oracle ZFS Storage Appliance Kit, version 8.8
  • PeopleSoft Enterprise HCM Human Resources, version 9.2
  • PeopleSoft Enterprise HCM Shared Components, version 9.2
  • PeopleSoft Enterprise PeopleTools, versions 8.59, 8.60, 8.61
  • Primavera Gateway, versions 19.12.0-19.12.19, 20.12.0-20.12.14, 21.12.0-21.12.12
  • Primavera Unifier, versions 19.12.0-19.12.16, 20.12.0-20.12.16, 21.12.0-21.12.17, 22.12.0-22.12.13, 23.12.0-23.12.6
  • Siebel Applications, versions 22.12 and prior, 23.12 and prior, 24.6 and prior
    •
    • JD Edwards EnterpriseOne Orchestrator, versions prior to 9.2.8.3
    • JD Edwards EnterpriseOne Tools, versions prior to 9.2.8.2
    • JD Edwards World Security, version A9.4
    • Management Pack for Oracle GoldenGate, version 12.2.1.2
    • MySQL Cluster, versions 7.5.34 and prior, 7.6.30 and prior, 8.0.37 and prior, 8.1.0 and prior, 8.3.0 and prior, 8.4.0 and prior
    • MySQL Connectors, versions 8.4.0 and prior
    • MySQL Enterprise Monitor, versions 8.0.38 and prior
    • MySQL Server, versions 8.0.37 and prior, 8.0.38, 8.2.0 and prior, 8.3.0 and prior, 8.4.0 and prior, 8.4.1, 9.0.0
    • MySQL Workbench, versions 8.0.36 and prior
    • Oracle Access Manager, version 12.2.1.4.0
    • Oracle Agile Engineering Data Management, versions 6.2.1.0-6.2.1.9
    • Oracle Analytics Desktop, versions prior to 7.7.0, prior to 7.8.0
    • Oracle Application Express, version 23.2
    • Oracle Application Testing Suite, version 13.3.0.1
    • Oracle Autovue for Agile Product Lifecycle Management, version 21.0.2
    • Oracle Banking Branch, versions 14.4.0.0.0, 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0
    • Oracle Banking Cash Management, versions 14.4.0.0.0, 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0
    • Oracle Banking Corporate Lending Process Management, versions 14.4.0.0.0, 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0
    • Oracle Banking Credit Facilities Process Management, versions 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0
    • Oracle Banking Deposits and Lines of Credit Servicing, version 2.12.0.0.0
    • Oracle Banking Liquidity Management, versions 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0
    • Oracle Banking Origination, versions 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0
    • Oracle Banking Party Management, version 2.7.0.0.0
    • Oracle Banking Platform, version 2.4.0.0.0
    • Oracle Banking Virtual Account Management, versions 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0
    • Oracle Big Data Spatial and Graph, version 3.0.6
    • Oracle Business Activity Monitoring, version 12.2.1.4.0
    • Oracle Business Intelligence Enterprise Edition, versions 7.0.0.0.0, 7.6.0.0.0, 12.2.1.4.0
    • Oracle Coherence, versions 12.2.1.4.0, 14.1.1.0.0
    • Oracle Commerce Guided Search, version 11.3.2
    • Oracle Commerce Platform, versions 11.3.0, 11.3.1, 11.3.2
    • Oracle Communications ASAP, version 7.4
    • Oracle Communications Billing and Revenue Management, versions 12.0.0.4.0-12.0.0.8.0, 15.0.0.0.0
    • Oracle Communications BRM - Elastic Charging Engine, versions 12.0.0.4-12.0.0.8, 15.0.0.0
    • Oracle Communications Cloud Native Core Automated Test Suite, versions 23.1.0, 23.4.0
    • Oracle Communications Cloud Native Core Binding Support Function, versions 23.4.0-23.4.3
    • Oracle Communications Cloud Native Core Console, versions 23.4.0, 23.4.1
    • Oracle Communications Cloud Native Core Network Data Analytics Function, version 24.2.0
    • Oracle Communications Cloud Native Core Network Exposure Function, version 23.4.3
    • Oracle Communications Cloud Native Core Network Function Cloud Native Environment, versions 23.4.0, 24.1.0
    • Oracle Communications Cloud Native Core Network Repository Function, version 23.4.2
    • Oracle Communications Cloud Native Core Policy, versions 23.4.0-23.4.4
    • Oracle Communications Cloud Native Core Security Edge Protection Proxy, versions 23.4.0, 24.1.0
    • Oracle Communications Cloud Native Core Service Communication Proxy, versions 23.4.0, 23.4.1, 23.4.2, 24.1.0
    • Oracle Communications Cloud Native Core Unified Data Repository, versions 23.4.1, 23.4.2
    • Oracle Communications Converged Charging System, versions 2.0.0.0.0, 2.0.0.1.0
    • Oracle Communications Convergent Charging Controller, versions 6.0.1.0.0, 12.0.1.0.0-12.0.6.0.0, 15.0.0.0.0
    • Oracle Communications Diameter Signaling Router, versions 8.6.0.4-8.6.0.8
    • Oracle Communications EAGLE Element Management System, versions 46.6.4, 46.6.5
    • Oracle Communications Element Manager, versions 9.0.0-9.0.3
    • Oracle Communications Network Analytics Data Director, versions 23.4.0, 24.1.0
    • Oracle Communications Network Charging and Control, versions 6.0.1.0.0, 12.0.1.0.0-12.0.6.0.0, 15.0.0.0.0
    • Oracle Communications Operations Monitor, versions 5.1, 5.2
    • Oracle Communications Performance Intelligence, version 10.5
    • Oracle Communications Policy Management, versions 12.6.1.0.0, 15.0.0.0.0
    • Oracle Communications Pricing Design Center, versions 12.0.0.4.0-12.0.0.8.0, 15.0.0.0.0
    • Oracle Communications Service Catalog and Design, versions 7.4.0-7.4.2, 8.0.0
    • Oracle Communications Session Border Controller, versions 4.1.0, 4.2.0, 9.2.0, 9.3.0
    • Oracle Communications Session Report Manager, versions 9.0.0-9.0.3
    • Oracle Communications Unified Assurance, versions 5.5.0-5.5.21, 6.0.0-6.0.4
    • Oracle Communications Unified Inventory Management, versions 7.4.1, 7.4.2
    • Oracle Communications User Data Repository, versions 12.11.0, 12.11.3, 12.11.4
    • Oracle Data Integrator, version 12.2.1.4.0
    • Oracle Database Server, versions 19.3-19.23, 21.3-21.14, 23.4
    • Oracle Documaker, versions 12.6.4, 12.7.1
    • Oracle E-Business Suite, versions 12.2.3-12.2.13
    • Oracle Enterprise Data Quality, version 12.2.1.4.0
    • Oracle Enterprise Manager Base Platform, version 13.5.0.0
    • Oracle Essbase, version 21.5.6
    • Oracle Financial Services Analytical Applications Infrastructure, versions 8.0.7, 8.0.8, 8.1.1, 8.1.2
    • Oracle Financial Services Basel Regulatory Capital Basic, versions 8.0.7.3, 8.0.8.3
    • Oracle Financial Services Basel Regulatory Capital Internal Ratings Based Approach, versions 8.0.7.3, 8.0.8.3
    • Oracle Financial Services Behavior Detection Platform, versions 8.0.8.1, 8.1.1.1, 8.1.2.6, 8.1.2.7
    • Oracle Financial Services Compliance Studio, versions 8.1.2.6, 8.1.2.7
    • Oracle Financial Services Enterprise Case Management, versions 8.0.8.2.8, 8.1.1.1.18, 8.1.2.6.4, 8.1.2.7.3
    • Oracle Financial Services Model Management and Governance, versions 8.1.2.5, 8.1.2.6
    • Oracle Financial Services Revenue Management and Billing, versions 6.0.0.0.0, 6.1.0.0.0
    • Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition, version 8.0.8.0
    • Oracle FLEXCUBE Investor Servicing, versions 14.5.0.0.0, 14.7.0.0.0
    • Oracle FLEXCUBE Universal Banking, versions 14.5.0.0.0, 14.6.0.0.0, 14.7.0.0.0
    • Oracle Fusion Middleware, version 12.2.1.4.0
    • Oracle Global Lifecycle Management NextGen OUI Framework, version 12.2.1.4.0
    • Oracle GoldenGate, versions 19.1.0.0.0-19.23.0.0.240716, 21.3-21.14
    • Oracle GoldenGate Big Data and Application Adapters, versions 19.1.0.0.0-19.1.0.0.18, 21.3-21.14.0.0.0
    • Oracle GoldenGate Studio, version 12.2.0.4.0
    • Oracle GraalVM Enterprise Edition, versions 20.3.14, 21.3.10
    • Oracle GraalVM for JDK, versions 17.0.11, 21.0.3, 22.0.1
    • Oracle Graph Server and Client, versions 22.4.7 and prior, 23.4.2 and prior, 24.1.0 and prior
    • Oracle Healthcare Data Repository, versions 8.1.4, 8.2.0
    • Oracle Healthcare Foundation, versions 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4
    • Oracle Healthcare Master Person Index, versions 5.0.0-5.0.9
    • Oracle HTTP Server, version 12.2.1.4.0
    • Oracle Hyperion Data Relationship Management, version 11.2.17.0.0
    • Oracle Hyperion Financial Close Management, version 11.2.17.0.0
    • Oracle Hyperion Infrastructure Technology, version 11.2.17.0.0
    • Oracle Identity Manager, version 12.2.1.4.0
    • Oracle Insurance Policy Administration J2EE, versions 11.2.12, 11.3.0-11.3.2
    • Oracle Java SE, versions 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1
    • Oracle JDeveloper, version 12.2.1.4.0
    • Oracle Middleware Common Libraries and Tools, version 12.2.1.4.0

      Overview

      Multiple vulnerabilities have been reported in various Oracle products which could be exploited by the attacker to conduct Denial of Service attack, Security Restriction Bypass, Information Disclosure and Data Manipulation on the targeted system.

      Description

      These vulnerabilities have been reported in various components of Oracle products.

      Successful exploitation of these vulnerabilities could allow an attacker to conduct Denial of Service attack, Security Restriction Bypass, Information Disclosure and Data Manipulation on the targeted system.

      Solution

      Apply appropriate updates as mentioned in Oracle updates:  
      https://www.oracle.com/security-alerts/cpujul2024.html

      Vendor Information

      Oracle
      https://www.oracle.com/security-alerts/cpujul2024.html

      References

      Oracle
      https://www.oracle.com/security-alerts/cpujul2024.html

      Disclaimer

      The information provided herein is on "as is" basis, without warranty of any kind.

      Contact Information

      Email: info@cert-in.org.in
      Phone: +91-11-22902657

      Postal address

      Indian Computer Emergency Response Team (CERT-In)
      Ministry of Electronics and Information Technology
      Government of India
      Electronics Niketan
      6, CGO Complex, Lodhi Road,
      New Delhi - 110 003
      India

       
    Indian Computer Emergency Response Team - CERT-In, Ministry of Electronics and Information Technology, Government of India.
    Website Policies |  Terms of Use |  Help Last Updated On December 08, 2024