Multiple vulnerabilities in Oracle Middleware Common Libraries and Tools



Risk High
Patch available YES
Number of vulnerabilities 3
CVE-ID CVE-2021-37714
CVE-2021-23926
CVE-2021-42575
CWE-ID CWE-835
CWE-776
CWE-20
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Oracle Middleware Common Libraries and Tools
Server applications / Other server solutions

Vendor Oracle

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Infinite loop

EUVDB-ID: #VU58176

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-37714

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop when processing untrusted HTML and XML code. A remote attacker can consume all available system resources and cause denial of service conditions.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Oracle Middleware Common Libraries and Tools: 12.2.1.3.0 - 12.2.1.4.0

CPE2.3 External links

https://www.oracle.com/security-alerts/cpujul2022.html?952641


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) XML Entity Expansion

EUVDB-ID: #VU49517

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-23926

CWE-ID: CWE-776 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper input validation when processing XML data. A remote attacker can pass specially crafted XML data to the application and perform XML Entity Expansion attacks.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Oracle Middleware Common Libraries and Tools: 12.2.1.3.0 - 12.2.1.4.0

CPE2.3 External links

https://www.oracle.com/security-alerts/cpujul2022.html?952641


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper input validation

EUVDB-ID: #VU59936

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-42575

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Platform, Data Persistence (OWASP Java HTML Sanitizer) component in Primavera Unifier. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Oracle Middleware Common Libraries and Tools: 12.2.1.3.0 - 12.2.1.4.0

CPE2.3 External links

https://www.oracle.com/security-alerts/cpujul2022.html?952641


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###