SB2021072112 - Multiple vulnerabilities in Essbase
Published: July 21, 2021 Updated: October 28, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Resource management error (CVE-ID: CVE-2019-12402)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to the file name encoding algorithm can get into an infinite loop when faced with
specially crafted inputs. A remote attacker can choose the file names inside of an archive created by Compress and cause a denial of service condition on the target system.
2) Resource exhaustion (CVE-ID: CVE-2020-7760)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources when processing regular expression. A remote attacker can trigger resource exhaustion and perform a regular expression denial of service (ReDoS) attack.
3) Uncontrolled Recursion (CVE-ID: CVE-2020-8285)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due tu uncontrolled recursion when processing FTP responses within the wildcard matching functionality, which allows a callback (set
with <a href="https://curl.se/libcurl/c/CURLOPT_CHUNK_BGN_FUNCTION.html">CURLOPT_CHUNK_BGN_FUNCTION</a>) to return information back to libcurl on
how to handle a specific entry in a directory when libcurl iterates over a
list of all available entries. A remote attacker who controls the malicious FTP server can trick the victim to connect to it and crash the application, which is using the affected libcurl version.
4) Infinite loop (CVE-ID: CVE-2019-0190)
The vulnerability allows a remote attacker to cause DoS condition on the target system.The weakness exists in the mod_ssl module due to improper handling of renegotiation attempts when OpenSSL 1.1.1 or later is used. A remote attacker can send a specially crafted request that submits malicious input, trigger mod_ssl loop and cause the service to crash.
Remediation
Install update from vendor's website.