CVE-2020-2968: High severity oracle database vulnerability

Published Jul 15, 2020

Updated

Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult to exploit vulnerability allows low privileged attacker having Create Session, Create Procedure privilege with network access via multiple protocols to compromise Java VM. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java VM, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java VM. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H).

Affected Software

5 affected components

Oracle Database Server=11.2.0.4

Oracle Database Server=12.1.0.2

Oracle Database Server=12.2.0.1

Oracle Database Server=18c

Oracle Database Server=19c

Remediation

Patch Available

https://www.oracle.com/security-alerts/cpujul2020.html

Event History

Jul 15, 2020

CVE Published

via MITRE·05:34 PM

Data Sourced

via MITRE·05:34 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2020-2968?

CVE-2020-2968 is a vulnerability in the Java VM component of Oracle Database Server.

Which versions of Oracle Database Server are affected by CVE-2020-2968?

Oracle Database Server versions 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, and 19c are affected by CVE-2020-2968.

What privileges does an attacker need to exploit CVE-2020-2968?

An attacker with Create Session and Create Procedure privileges, and network access, can exploit CVE-2020-2968.

What is the severity of CVE-2020-2968?

CVE-2020-2968 has a severity rating of high.

How can I fix CVE-2020-2968?

To fix CVE-2020-2968, apply the necessary patches and updates provided by Oracle.