SB2021012216 - Multiple vulnerabilities in Oracle Banking Supply Chain Finance
Published: January 22, 2021
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Insufficient verification of data authenticity (CVE-ID: CVE-2019-11269)
The vulnerability allows a remote attacker to redirect victims to arbitrary URL.
The vulnerability exists due to the application relies on the URL passed via the "redirect_uri" parameter. A remote attacker can create a specially crafted link that once clicked will cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker after successful authentication. As a result the attacker can gain authorization code and bypass OAuth authentication.
2) Use of insufficiently random values (CVE-ID: CVE-2020-5408)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the affected software uses a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A remote authenticated attacker can derive the unencrypted values using a dictionary attack.
3) Information disclosure (CVE-ID: CVE-2019-12399)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output within the Apache Kafka Connect REST API tasks endpoint. A remote authenticated user can issue a request to the same Connect cluster to obtain the connector's task configurations and the response will contain the plaintext secret.
4) Resource exhaustion (CVE-ID: CVE-2020-11612)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources within ZlibDecoders in Netty while decoding a ZlibEncoded byte stream. A remote attacker can trigger resource exhaustion by passing an overly large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder.
Remediation
Install update from vendor's website.