Latest oracle communications cloud native core service communication proxy Vulnerabilities

● CVE-2022-22947

VMware Spring Cloud Gateway Code Injection Vulnerability

maven/org.springframework.cloud:spring-cloud-gateway>=3.1.0<3.1.1

maven/org.springframework.cloud:spring-cloud-gateway<3.0.7

VMware Spring Cloud Gateway

VMware Spring Cloud Gateway<3.0.7

VMware Spring Cloud Gateway=3.1.0

Oracle Commerce Guided Search=11.3.2

and 13 more

● CVE-2021-22060

In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This...

VMware Spring Framework>=5.2.0<=5.2.18

VMware Spring Framework>=5.3.0<=5.3.13

Oracle Communications Cloud Native Core Console=1.9.0

Oracle Communications Cloud Native Core Service Communication Proxy=1.15.0

● CVE-2021-45105

Apache Log4j StrSubstitutor Uncontrolled Recursion Denial-of-Service Vulnerability

redhat/eap7-log4j<0:2.17.1-1.redhat_00001.1.el8ea

redhat/eap7-log4j<0:2.17.1-1.redhat_00001.1.el7ea

redhat/rh-sso7-keycloak<0:15.0.6-1.redhat_00001.1.el7

redhat/rh-sso7-keycloak<0:15.0.6-1.redhat_00001.1.el8

debian/apache-log4j2

debian/apache-log4j2<=2.16.0-1~deb10u1<=2.16.0-1<=2.16.0-1~deb11u1

and 217 more

● CVE-2021-22096

In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries.

redhat/ovirt-dependencies<0:4.5.2-1.el8e

VMware Spring Framework>=5.2.0<=5.2.17

VMware Spring Framework>=5.3.0<=5.3.10

Netapp Active Iq Unified Manager Linux

Netapp Active Iq Unified Manager Vsphere

Netapp Active Iq Unified Manager Windows

and 6 more

● CVE-2021-22947

curl. Multiple issues were addressed by updating to curl version 7.79.1.

redhat/rh-dotnet31-curl<0:7.61.1-22.el7_9

redhat/curl<0:7.61.1-18.el8_4.2

redhat/curl<0:7.61.1-12.el8_2.4

debian/curl<=7.64.0-4+deb10u2

Apple macOS Monterey<12.3

redhat/curl<7.79.0

and 62 more

● CVE-2021-22946

curl. Multiple issues were addressed by updating to curl version 7.79.1.

redhat/rh-dotnet31-curl<0:7.61.1-22.el7_9

redhat/curl<0:7.61.1-18.el8_4.2

redhat/curl<0:7.61.1-12.el8_2.4

debian/curl<=7.64.0-4+deb10u2

Apple macOS Monterey<12.3

IBM QRadar SIEM<=7.5.0 GA

and 68 more

● CVE-2021-34429

For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security co...

redhat/jetty<9.4.43

redhat/jetty<10.0.6

redhat/jetty<11.0.6

Eclipse Jetty>=9.4.37<9.4.43

Eclipse Jetty>=10.0.1<10.0.6

Eclipse Jetty>=11.0.1<11.0.6

and 19 more

● CVE-2021-36090

A flaw was found in apache-commons-compress. When reading a specially crafted ZIP archive, Compress can allocate large amounts of memory that leads to an out-of-memory error for small inputs. This fla...

redhat/apache-commons-compress<0:1.21-1.2.el8e

IBM Cloud Pak System<=V2.3.0 - V2.3.3.3 Interim Fix 1

redhat/apache-commons-compress<1.21

Apache Commons Compress>=1.0<1.21

Oracle Banking Apis>=18.1<=18.3

Oracle Banking Apis=19.1

and 69 more

● CVE-2021-35515

A flaw was found in apache-commons-compress. When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This flaw allo...

redhat/apache-commons-compress<0:1.21-1.2.el8e

redhat/apache-commons-compress<1.21

Apache Commons Compress>=1.6<=1.20

Netapp Active Iq Unified Manager Linux

Netapp Active Iq Unified Manager Vmware Vsphere

Netapp Active Iq Unified Manager Windows

and 43 more

● CVE-2021-35517

A flaw was found in apache-commons-compress. When reading a specially crafted TAR archive, Compress can allocate large amounts of memory that leads to an out-of-memory error for small inputs. This fla...

redhat/apache-commons-compress<0:1.21-1.2.el8e

redhat/apache-commons-compress<1.21

Apache Commons Compress>=1.1<=1.20

Netapp Active Iq Unified Manager Linux

Netapp Active Iq Unified Manager Vmware Vsphere

Netapp Active Iq Unified Manager Windows

and 50 more

● CVE-2021-35516

A flaw was found in apache-commons-compress. When reading a specially crafted 7Z archive, Compress can allocate large amounts of memory that leads to an out-of-memory error for very small inputs. This...

redhat/apache-commons-compress<0:1.21-1.2.el8e

redhat/apache-commons-compress<1.21

Apache Commons Compress>=1.6<=1.20

Netapp Active Iq Unified Manager Linux

Netapp Active Iq Unified Manager Vmware Vsphere

Netapp Active Iq Unified Manager Windows

and 43 more

● CVE-2021-33037

Apache Tomcat is vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially-crafted HTTP(S) transfer-encoding request header,...

redhat/jws5-tomcat<0:9.0.50-3.redhat_00004.1.el7

redhat/jws5-tomcat-native<0:1.2.30-3.redhat_3.el7

redhat/jws5-tomcat-vault<0:1.1.8-4.Final_redhat_00004.1.el7

redhat/jws5-tomcat<0:9.0.50-3.redhat_00004.1.el8

redhat/jws5-tomcat-native<0:1.2.30-3.redhat_3.el8

redhat/jws5-tomcat-vault<0:1.1.8-4.Final_redhat_00004.1.el8

and 91 more

● CVE-2021-22897

curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The se...

Haxx Curl>=7.61.0<=7.76.1

Oracle Communications Cloud Native Core Binding Support Function=1.11.0

Oracle Communications Cloud Native Core Network Function Cloud Native Environment=1.10.0

Oracle Communications Cloud Native Core Network Repository Function=1.15.0

Oracle Communications Cloud Native Core Network Repository Function=1.15.1

Oracle Communications Cloud Native Core Network Slice Selection Function=1.8.0

and 45 more

● CVE-2021-33560

Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appr...

GnuPG Libgcrypt<1.8.8

GnuPG Libgcrypt>=1.9.0<1.9.3

Debian Debian Linux=9.0

Fedoraproject Fedora=33

Fedoraproject Fedora=34

Oracle Communications Cloud Native Core Binding Support Function=1.11.0

and 10 more

● CVE-2021-33880

The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An a...

Websockets Project Websockets Python<9.1

Oracle Communications Cloud Native Core Policy=1.14.0

Oracle Communications Cloud Native Core Security Edge Protection Proxy=1.5.0

Oracle Communications Cloud Native Core Service Communication Proxy=1.14.0

Oracle Communications Cloud Native Core Unified Data Repository=1.14.0

● CVE-2021-22898

cURL libcurl could allow a remote attacker to obtain sensitive information, caused by a flaw in the option parser for sending NEW_ENV variables. By sending a specially-crafted request using a clear-te...

redhat/curl<0:7.61.1-22.el8

debian/curl<=7.64.0-4+deb10u2

debian/curl<=7.74.0-1.2<=7.64.0-4<=7.64.0-4+deb10u2<=7.64.0-4+deb10u1

Haxx Curl>=7.7<=7.76.1

Debian Debian Linux=9.0

Fedoraproject Fedora=33

and 19 more

● CVE-2021-22118

In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a...

maven/org.springframework:spring-web>=5.3.0<=5.3.6

maven/org.springframework:spring-web>=5.2.0<=5.2.14

IBM DRM<=2.0.6

redhat/spring-framework<5.3.7

redhat/spring-framework<5.2.15

VMware Spring Framework>=5.2.0<5.2.15

and 48 more

● CVE-2021-22901

A use-after-free flaw was found in the way curl handled TLS session data. The curl versions using the OpenSSL library as their TLS backend could use freed memory after TLS session renegotiation was pe...

redhat/jbcs-httpd24<0:1-18.el8

redhat/jbcs-httpd24-apr<0:1.6.3-105.el8

redhat/jbcs-httpd24-apr-util<0:1.6.1-82.el8

redhat/jbcs-httpd24-brotli<0:1.0.6-40.el8

redhat/jbcs-httpd24-curl<0:7.77.0-2.el8

redhat/jbcs-httpd24-httpd<0:2.4.37-74.el8

and 68 more

● CVE-2020-27618

GNU C Library (aka glibc or libc6) is vulnerable to a denial of service, caused by an error when processing some invalid inputs from several IBM character sets in the iconv function. By sending invali...

IBM Security Verify Access<=10.0.0

GNU glibc<=2.32

NetApp ONTAP Select Deploy administration utility

Netapp A250 Firmware

Netapp A250

Netapp 500f Firmware

and 44 more

● CVE-2020-29582

In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permiss...

redhat/kotlin<1.4.21

JetBrains Kotlin<1.4.21

Oracle Communications Cloud Native Core Network Slice Selection Function=1.2.1

Oracle Communications Cloud Native Core Policy=1.14.0

Oracle Communications Cloud Native Core Service Communication Proxy=1.14.0

● CVE-2020-8554

Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker...

redhat/atomic-openshift<0:3.11.374-1.git.0.ebd3ee9.el7

Kubernetes Kubernetes

Oracle Communications Cloud Native Core Network Slice Selection Function=1.2.1

Oracle Communications Cloud Native Core Policy=1.15.0

Oracle Communications Cloud Native Core Service Communication Proxy=1.14.0

● CVE-2020-13956

Apache HttpClient could allow a remote attacker to bypass security restrictions, caused by the improper handling of malformed authority component in request URIs. By passing request URIs to the librar...

redhat/eap7-activemq-artemis<0:2.9.0-7.redhat_00017.1.el6ea

redhat/eap7-glassfish-jsf<0:2.3.9-12.SP13_redhat_00001.1.el6ea

redhat/eap7-hal-console<0:3.2.12-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate<0:5.3.20-1.Final_redhat_00001.1.el6ea

redhat/eap7-httpcomponents-client<0:4.5.13-1.redhat_00001.1.el6ea

redhat/eap7-jboss-ejb-client<0:4.0.37-1.Final_redhat_00001.1.el6ea

and 88 more

● CVE-2020-36518

A flaw was found in the Jackson Databind package. This cause of the issue is due to a Java StackOverflow exception and a denial of service via a significant depth of nested objects.

debian/jackson-databind<=2.9.8-3+deb10u3

redhat/jackson-databind<0:2.14.1-2.el9

redhat/eap7-jackson-databind<0:2.12.6.1-1.redhat_00003.1.el8ea

redhat/eap7-jackson-databind<0:2.12.6.1-1.redhat_00003.1.el7ea

redhat/rh-sso7-keycloak<0:15.0.8-1.redhat_00001.1.el7

redhat/rh-sso7-keycloak<0:15.0.8-1.redhat_00001.1.el8

and 88 more

● CVE-2020-14340

A flaw was found in xnio. A file descriptor leak caused by growing amounts of NIO Selector file, handled between garbage collection cycles, may allow the attacker to cause a denial of service. The hig...

redhat/eap7-activemq-artemis<0:2.9.0-5.redhat_00011.1.el6ea

redhat/eap7-activemq-artemis-native<1:1.0.2-1.redhat_00001.1.el6ea

redhat/eap7-apache-commons-codec<0:1.14.0-1.redhat_00001.1.el6ea

redhat/eap7-apache-commons-lang<0:3.10.0-1.redhat_00001.1.el6ea

redhat/eap7-apache-cxf<0:3.3.7-1.redhat_00001.1.el6ea

redhat/eap7-artemis-native<1:1.0.2-3.redhat_1.el6ea

and 102 more

● CVE-2020-11612

The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server...

redhat/qpid-cpp<0:1.36.0-30.el6_10a

redhat/qpid-proton<0:0.31.0-3.el6_10

redhat/qpid-cpp<0:1.36.0-30.el7a

redhat/qpid-proton<0:0.31.0-3.el7

redhat/nodejs-rhea<0:1.0.21-1.el8

redhat/qpid-cpp<0:1.39.0-5.el8a

and 72 more

● CVE-2019-10219

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This...

redhat/eap7-apache-cxf<0:3.2.11-1.redhat_00001.1.el6ea

redhat/eap7-glassfish-jsf<0:2.3.5-6.SP3_redhat_00004.1.el6ea

redhat/eap7-hal-console<0:3.0.19-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate<0:5.3.14-1.Final_redhat_00001.1.el6ea

redhat/eap7-hibernate-validator<0:6.0.18-1.Final_redhat_00001.1.el6ea

redhat/eap7-jackson-annotations<0:2.9.10-1.redhat_00003.1.el6ea

and 779 more

Latest oracle communications cloud native core service communication proxy Vulnerabilities

Company

Resources

Contact