Latest oracle communications cloud native core policy vulnerabilities since last week (CVE List)

● CVE-2023-21971

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.32 and prior. Difficult to exploit vulnerability allows high privi...

Oracle Communications Cloud Native Core Binding Support Function=22.4.0

Oracle Communications Cloud Native Core Binding Support Function=23.1.0

Oracle Communications Cloud Native Core Policy=22.4.0

Oracle Communications Cloud Native Core Policy=23.1.0

Oracle Mysql Connectors>=8.0.0<=8.0.32

Netapp Active Iq Unified Manager Linux

and 4 more

● CVE-2023-21824

Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications Applications (component: Customer, Config, Pricing Manager). Supported versions that are affe...

Oracle Communications Billing And Revenue Management Elastic Charging Engine>=12.0.0.3.0<=12.0.0.7.0

Oracle Communications Cloud Native Core Binding Support Function=22.3.0

Oracle Communications Cloud Native Core Policy=22.3.0

● CVE-2022-22963

VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability

VMware Tanzu Spring Cloud

Vmware Spring Cloud Function<=3.1.6

Vmware Spring Cloud Function>=3.2.0<=3.2.2

Oracle Banking Branch=14.5

Oracle Banking Cash Management=14.5

Oracle Banking Corporate Lending Process Management=14.5

and 42 more

● CVE-2022-22965

Spring Framework JDK 9+ Remote Code Execution Vulnerability

VMware Spring Framework

VMware Spring Framework<5.2.20

VMware Spring Framework>=5.3.0<5.3.18

Cisco CX Cloud Agent<2.1.0

Oracle Communications Cloud Native Core Automated Test Suite=1.9.0

Oracle Communications Cloud Native Core Automated Test Suite=22.1.0

and 84 more

● CVE-2022-0002

Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.

redhat/kernel-rt<0:4.18.0-372.9.1.rt7.166.el8

redhat/kernel<0:4.18.0-372.9.1.el8

Intel Atom C3308

Intel Atom C3336

Intel Atom C3338

Intel Atom C3338r

and 623 more

● CVE-2022-0001

Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.

redhat/kernel-rt<0:4.18.0-372.9.1.rt7.166.el8

redhat/kernel<0:4.18.0-372.9.1.el8

Intel Atom P5921b

Intel Atom P5931b

Intel Atom P5942b

Intel Atom P5962b

and 578 more

● CVE-2022-25636

An out-of-bounds (OOB) memory access flaw was found in nft_fwd_dup_netdev_offload in net/netfilter/nf_dup_netdev.c in netfilter subcomponent in the Linux kernel due to a heap out of bounds write probl...

redhat/kernel-rt<0:4.18.0-348.23.1.rt7.153.el8_5

redhat/kernel<0:4.18.0-348.23.1.el8_5

redhat/kernel-rt<0:4.18.0-305.45.1.rt7.117.el8_4

redhat/kernel<0:4.18.0-305.45.1.el8_4

Linux Linux kernel>=5.4<5.4.182

Linux Linux kernel>=5.5<5.10.103

and 128 more

● CVE-2022-23181

The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed ...

redhat/jws5-tomcat<0:9.0.62-9.redhat_00005.1.el7

redhat/jws5-tomcat<0:9.0.62-9.redhat_00005.1.el8

redhat/jws5-tomcat<0:9.0.62-9.redhat_00005.1.el9

debian/tomcat9<=9.0.31-1~deb10u6

Apache Tomcat>=8.5.55<=8.5.73

Apache Tomcat>=9.0.35<=9.0.56

and 24 more

● CVE-2021-22569

A flaw was found in protobuf-java. Google Protocol Buffer (protobuf-java) allows the interleaving of com.google.protobuf.UnknownFieldSet fields. By persuading a victim to open specially-crafted conten...

IBM Security Verify Governance<=10.0

redhat/protobuf<3.16.1

redhat/protobuf<3.18.2

redhat/protobuf<3.19.2

Google Google-protobuf Ruby<3.19.2

Google Protobuf-java<3.16.1

and 10 more

● CVE-2021-42392

The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to...

H2database H2>=1.1.000<=2.0.204

Debian Debian Linux=9.0

Debian Debian Linux=10.0

Debian Debian Linux=11.0

Oracle Communications Cloud Native Core Policy=1.15.0

redhat/eap7-h2database<0:1.4.197-2.redhat_00004.1.el8ea

and 9 more

● CVE-2021-45105

Apache Log4j StrSubstitutor Uncontrolled Recursion Denial-of-Service Vulnerability

redhat/eap7-log4j<0:2.17.1-1.redhat_00001.1.el8ea

redhat/eap7-log4j<0:2.17.1-1.redhat_00001.1.el7ea

redhat/rh-sso7-keycloak<0:15.0.6-1.redhat_00001.1.el7

redhat/rh-sso7-keycloak<0:15.0.6-1.redhat_00001.1.el8

debian/apache-log4j2

debian/apache-log4j2<=2.16.0-1~deb10u1<=2.16.0-1<=2.16.0-1~deb11u1

and 217 more

● CVE-2021-34141

An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor stat...

NumPy NumPy<1.22.0

Oracle Communications Cloud Native Core Policy=22.1.3

● CVE-2021-43818

lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content ...

redhat/python-lxml<4.6.5

redhat/python-lxml<0:4.2.3-4.el8

redhat/python-lxml<0:4.7.1-1.el8

redhat/rh-python38-python-lxml<0:4.4.1-8.el7

debian/lxml

Lxml Lxml<4.6.5

and 15 more

● CVE-2021-43797

### Impact Netty currently just skips control chars when these are present at the beginning / end of the header name. We should better fail fast as these are not allowed by the spec and could lead to...

redhat/eap7-netty<0:4.1.72-4.Final_redhat_00001.1.el8ea

redhat/eap7-netty<0:4.1.72-4.Final_redhat_00001.1.el7ea

redhat/candlepin<0:4.1.13-1.el7

redhat/candlepin<0:4.1.13-1.el8

redhat/rh-sso7-keycloak<0:15.0.8-1.redhat_00001.1.el7

redhat/rh-sso7-keycloak<0:15.0.8-1.redhat_00001.1.el8

and 60 more

● CVE-2021-4083

A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close() and fget() simultaneously and can potentially trigge...

Linux Linux kernel<4.4.294

Linux Linux kernel>=4.5<4.9.292

Linux Linux kernel>=4.10<4.14.257

Linux Linux kernel>=4.15<4.19.220

Linux Linux kernel>=4.20<5.4.164

Linux Linux kernel>=5.5.0<5.10.84

and 206 more

● CVE-2021-4002

A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memory twice using shmget() which are aligned to PUD alignment with the fault of some...

redhat/kernel-rt<0:4.18.0-372.9.1.rt7.166.el8

redhat/kernel<0:4.18.0-372.9.1.el8

Linux Linux kernel<5.16

Linux Linux kernel=5.16

Linux Linux kernel=5.16-rc1

Linux Linux kernel=5.16-rc2

and 139 more

● CVE-2021-43976

In the Linux kernel through 5.15.2, mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker (who can connect a crafted USB device) to cause a denial of service (skb_over_pani...

redhat/kernel-rt<0:4.18.0-372.9.1.rt7.166.el8

redhat/kernel<0:4.18.0-372.9.1.el8

Linux Linux kernel<=5.15.2

Fedoraproject Fedora=34

Fedoraproject Fedora=35

Debian Debian Linux=9.0

and 159 more

● CVE-2021-35574

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). The supported version that is affected is 8.5.5. Easily exploitable vulnerability...

Oracle Communications Cloud Native Core Policy=1.15.0

Oracle Outside In Technology=8.5.5

● CVE-2021-2471

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.26 and prior. Difficult to exploit vulnerability allows high privil...

redhat/MySQL Connector/J<8.0.27

Oracle Communications Cloud Native Core Console=1.9.0

Oracle Communications Cloud Native Core Network Slice Selection Function=1.8.0

Oracle Communications Cloud Native Core Policy=1.15.0

Oracle Communications Cloud Native Core Security Edge Protection Proxy=1.7.0

Oracle Mysql Connectors>=8.0.0<=8.0.26

and 2 more

● CVE-2022-0322

A flaw was found in the sctp_make_strreset_req function in net/sctp/sm_make_chunk.c in the SCTP network protocol in the Linux kernel with a local user privilege access. In this flaw, an attempt to use...

redhat/kernel<5.15

redhat/kernel-rt<0:4.18.0-372.9.1.rt7.166.el8

redhat/kernel<0:4.18.0-372.9.1.el8

Linux Linux kernel<5.15

Linux Linux kernel=5.15

Linux Linux kernel=5.15-rc1

and 9 more

● CVE-2021-4203

A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (and connect()) in the Linux kernel. In this flaw, an attacker with...

redhat/kernel-rt<0:4.18.0-372.9.1.rt7.166.el8

redhat/kernel<0:4.18.0-372.9.1.el8

redhat/kernel-rt<0:4.18.0-305.57.1.rt7.129.el8_4

redhat/kernel<0:4.18.0-305.57.1.el8_4

Linux Linux kernel<5.15

Linux Linux kernel=5.15

and 175 more

● CVE-2021-43389

An issue was discovered in the Linux kernel before 5.14.15. There is an array-index-out-of-bounds flaw in the detach_capi_ctr function in drivers/isdn/capi/kcapi.c.

redhat/kernel-rt<0:4.18.0-372.9.1.rt7.166.el8

redhat/kernel<0:4.18.0-372.9.1.el8

Linux Linux kernel<5.14.15

Redhat Enterprise Linux=8.0

Debian Debian Linux=9.0

Debian Debian Linux=10.0

and 135 more

● CVE-2021-38153

Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful...

maven/org.apache.kafka:kafka-clients=2.8.0

maven/org.apache.kafka:kafka-clients>=2.7.0<2.7.2

maven/org.apache.kafka:kafka-clients>=2.0.0<2.6.3

maven/org.apache.kafka:kafka_2.13=2.8.0

maven/org.apache.kafka:kafka_2.13>=2.7.0<2.7.2

maven/org.apache.kafka:kafka_2.13>=2.4.0<2.6.3

and 26 more

● CVE-2021-3807

A regular expression denial of service (ReDoS) vulnerability was found in nodejs-ansi-regex. This could possibly cause an application using ansi-regex to use an excessive amount of CPU time when match...

npm/ansi-regex>=3.0.0<3.0.1

npm/ansi-regex>=4.0.0<4.1.1

npm/ansi-regex>=5.0.0<5.0.1

npm/ansi-regex>=6.0.0<6.0.1

redhat/nodejs-nodemon<0:2.0.19-1.el9_0

redhat/rh-nodejs14-nodejs<0:14.18.2-1.el7

and 11 more

● CVE-2021-23440

This affects the package `set-value`. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.

Set-value Project Set-value<2.0.1

Set-value Project Set-value>=3.0.0<4.0.1

Oracle Communications Cloud Native Core Policy=1.14.0

npm/set-value>=3.0.0<3.0.3

npm/set-value>=4.0.0<4.0.1

npm/set-value<2.0.1

and 1 more

● CVE-2021-37136

### Impact The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users o...

maven/io.netty:netty<4.0.0

maven/org.jboss.netty:netty<4.0.0

maven/io.netty:netty-codec<4.1.68.Final

Netty Netty<4.1.68

Quarkus Quarkus<2.2.4

Oracle Banking Apis>=18.1<=18.3

and 44 more

● CVE-2021-3773

A flaw in netfilter could allow a network-connected attacker to infer openvpn connection endpoint information for further use in traditional network attacks.

redhat/kernel-rt<0:4.18.0-372.9.1.rt7.166.el8

redhat/kernel<0:4.18.0-372.9.1.el8

Linux Linux kernel<5.14

Linux Linux kernel>=5.15<5.15.15

Fedoraproject Fedora=34

Redhat Enterprise Linux=6.0

and 5 more

● CVE-2021-3772

A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through invalid chunks if the attacker knows the IP-addresses and port numbers being used an...

redhat/kernel-rt<0:4.18.0-372.9.1.rt7.166.el8

redhat/kernel<0:4.18.0-372.9.1.el8

ubuntu/linux<4.15.0-184.194

ubuntu/linux<5.4.0-117.132

ubuntu/linux<5.13.0-28.31

ubuntu/linux<5.15

and 195 more

● CVE-2021-3752

A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket and disconnect simultaneously due to a race condition. This flaw allows a user to ...

redhat/kernel-rt<0:3.10.0-1160.59.1.rt56.1200.el7

redhat/kernel<0:3.10.0-1160.59.1.el7

redhat/kernel-rt<0:4.18.0-372.9.1.rt7.166.el8

redhat/kernel<0:4.18.0-372.9.1.el8

Linux Linux kernel>=2.6.12<4.4.293

Linux Linux kernel>=4.5<4.9.291

and 192 more

● CVE-2021-20322

A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw all...

redhat/kernel-rt<0:4.18.0-372.9.1.rt7.166.el8

redhat/kernel<0:4.18.0-372.9.1.el8

redhat/kernel-rt<0:4.18.0-305.49.1.rt7.121.el8_4

redhat/kernel<0:4.18.0-305.49.1.el8_4

redhat/kernel<5.15

ubuntu/linux-aws<4.15.0-1119.127

and 186 more

● CVE-2021-39145

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only b...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Debian Debian Linux=9.0

Debian Debian Linux=10.0

and 33 more

● CVE-2021-39154

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only b...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Fedoraproject Fedora=33

Fedoraproject Fedora=34

and 33 more

● CVE-2021-39146

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only b...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Fedoraproject Fedora=33

Fedoraproject Fedora=34

and 33 more

● CVE-2021-39148

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only b...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Fedoraproject Fedora=33

Fedoraproject Fedora=34

and 33 more

● CVE-2021-39147

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only b...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Fedoraproject Fedora=33

Fedoraproject Fedora=34

and 33 more

● CVE-2021-39149

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only b...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Fedoraproject Fedora=33

Fedoraproject Fedora=34

and 33 more

● CVE-2021-39139

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only b...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Debian Debian Linux=9.0

Debian Debian Linux=10.0

and 33 more

● CVE-2021-39144

XStream Remote Code Execution Vulnerability

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

XStream XStream

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Debian Debian Linux=9.0

and 34 more

● CVE-2021-39151

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only b...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Fedoraproject Fedora=33

Fedoraproject Fedora=34

and 33 more

● CVE-2021-39152

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicl...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Fedoraproject Fedora=33

Fedoraproject Fedora=34

and 33 more

● CVE-2021-39140

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on ...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Debian Debian Linux=9.0

Debian Debian Linux=10.0

and 33 more

● CVE-2021-39150

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicl...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Fedoraproject Fedora=33

Fedoraproject Fedora=34

and 33 more

● CVE-2021-39141

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only b...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Debian Debian Linux=9.0

Debian Debian Linux=10.0

and 33 more

● CVE-2021-39153

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only b...

redhat/xstream<0:1.3.1-16.el7_9

debian/libxstream-java

redhat/xstream<1.4.18

Xstream Project Xstream<1.4.18

Fedoraproject Fedora=33

Fedoraproject Fedora=34

and 27 more

● CVE-2021-3744

A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a denial of service (memory consumption). This v...

redhat/kernel-rt<0:4.18.0-372.9.1.rt7.166.el8

redhat/kernel<0:4.18.0-372.9.1.el8

Linux Linux kernel<5.15

Linux Linux kernel=5.15

Linux Linux kernel=5.15-rc1

Linux Linux kernel=5.15-rc2

and 157 more

● CVE-2021-3743

An out-of-bounds (OOB) memory read flaw was found in the Qualcomm IPC router protocol in the Linux kernel. A missing sanity check allows a local attacker to gain access to out-of-bounds memory, leadin...

redhat/kernel-rt<0:4.18.0-372.9.1.rt7.166.el8

redhat/kernel<0:4.18.0-372.9.1.el8

Linux Linux kernel>5.14.1<5.17

Linux Linux kernel=5.14-rc6

Linux Linux kernel=5.17

Linux Linux kernel=5.17-rc1

and 174 more

● CVE-2021-32827

MockServer is open source software which enables easy mocking of any system you integrate with via HTTP or HTTPS. An attacker that can trick a victim into visiting a malicious site while running MockS...

Mock-server Mockserver

Oracle Communications Cloud Native Core Policy=1.14.0

● CVE-2021-3737

A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite...

redhat/python3<0:3.6.8-45.el8

redhat/python27-python<0:2.7.18-4.el7

IBM Cloud Pak for Security<=1.10.0.0 - 1.10.11.0

IBM QRadar Suite Software<=1.10.12.0 - 1.10.16.0

redhat/python<3.6.14

redhat/python<3.7.11

and 41 more

● CVE-2021-30640

Apache Tomcat could allow a remote attacker to bypass security restrictions, caused by improper authentication validation in the JNDI Realm. By sending a specially-crafted request using various user n...

redhat/jws5-tomcat<0:9.0.50-3.redhat_00004.1.el7

redhat/jws5-tomcat-native<0:1.2.30-3.redhat_3.el7

redhat/jws5-tomcat-vault<0:1.1.8-4.Final_redhat_00004.1.el7

redhat/jws5-tomcat<0:9.0.50-3.redhat_00004.1.el8

redhat/jws5-tomcat-native<0:1.2.30-3.redhat_3.el8

redhat/jws5-tomcat-vault<0:1.1.8-4.Final_redhat_00004.1.el8

and 20 more

● CVE-2021-33037

Apache Tomcat is vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially-crafted HTTP(S) transfer-encoding request header,...

redhat/jws5-tomcat<0:9.0.50-3.redhat_00004.1.el7

redhat/jws5-tomcat-native<0:1.2.30-3.redhat_3.el7

redhat/jws5-tomcat-vault<0:1.1.8-4.Final_redhat_00004.1.el7

redhat/jws5-tomcat<0:9.0.50-3.redhat_00004.1.el8

redhat/jws5-tomcat-native<0:1.2.30-3.redhat_3.el8

redhat/jws5-tomcat-vault<0:1.1.8-4.Final_redhat_00004.1.el8

and 91 more

Latest oracle communications cloud native core policy Vulnerabilities

Company

Resources

Contact