csaf_ncscnl - ncsc-2024-0291

NCSC-2024-0291

Vulnerability from csaf_ncscnl - Published: 2024-07-17 13:51 - Updated: 2024-07-17 13:51

Summary

Kwetsbaarheden verholpen in Oracle Database Server

Notes

The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.

Feiten

Er zijn kwetsbaarheden verholpen in Oracle Database Server.

Interpretaties

Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade: * Denial-of-Service (DoS) * Toegang tot gevoelige gegevens * Manipulatie van gegevens * Omzeilen van beveiligingsmaatregel

Oplossingen

Oracle heeft updates beschikbaar gesteld om de kwetsbaarheden te verhelpen. Zie de referenties voor meer informatie.

Kans

medium

Schade

high

CWE-285

Improper Authorization

CWE-404

Improper Resource Shutdown or Release

CWE-674

Uncontrolled Recursion

JSON

To clipboard

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Er zijn kwetsbaarheden verholpen in Oracle Database Server.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorie\u00ebn schade:\n\n* Denial-of-Service (DoS)\n* Toegang tot gevoelige gegevens\n* Manipulatie van gegevens\n* Omzeilen van beveiligingsmaatregel",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Oracle heeft updates beschikbaar gesteld om de kwetsbaarheden te verhelpen. Zie de referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Improper Authorization",
        "title": "CWE-285"
      },
      {
        "category": "general",
        "text": "Improper Resource Shutdown or Release",
        "title": "CWE-404"
      },
      {
        "category": "general",
        "text": "Uncontrolled Recursion",
        "title": "CWE-674"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Source - nvd",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0397"
      },
      {
        "category": "external",
        "summary": "Source - nvd",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21098"
      },
      {
        "category": "external",
        "summary": "Source - nvd",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21123"
      },
      {
        "category": "external",
        "summary": "Source - nvd",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21126"
      },
      {
        "category": "external",
        "summary": "Source - nvd",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21174"
      },
      {
        "category": "external",
        "summary": "Source - nvd",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21184"
      },
      {
        "category": "external",
        "summary": "Source - nvd",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4603"
      },
      {
        "category": "external",
        "summary": "Reference - oracle",
        "url": "https://www.oracle.com/docs/tech/security-alerts/cpujul2024csaf.json"
      },
      {
        "category": "external",
        "summary": "Reference - cveprojectv5; ibm; nvd; oracle",
        "url": "https://www.oracle.com/security-alerts/cpujul2024.html"
      }
    ],
    "title": " Kwetsbaarheden verholpen in Oracle Database Server",
    "tracking": {
      "current_release_date": "2024-07-17T13:51:54.185475Z",
      "id": "NCSC-2024-0291",
      "initial_release_date": "2024-07-17T13:51:54.185475Z",
      "revision_history": [
        {
          "date": "2024-07-17T13:51:54.185475Z",
          "number": "0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-764785",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:__database___19c:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-764790",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:__database___21c:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-764843",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:__database_-_machine_learning_for_python___21c:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-1503607",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:__database_core___23.4:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-764838",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:__database_data_redaction___19c:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-764844",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:__database_data_redaction___21c:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-764839",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:__database_fleet_patching___19c:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-764845",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:__database_fleet_patching___21c:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-764787",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:__database_oml4py___21c:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-764846",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:__database_portable_clusterware___21c:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-764840",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:__database_rdbms_security___19c:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-764847",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:__database_rdbms_security___21c:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-764784",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:__database_recovery_manager___19c:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-764788",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:__database_recovery_manager___21c:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-764841",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:__database_sqlcl___19c:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-764848",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:__database_sqlcl___21c:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-764789",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:__database_workload_manager___21c:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-764842",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:_graalvm_multilingual_engine___21c:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-764783",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:_java_vm___19c:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-764786",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:_java_vm___21c:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-1503604",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:_java_vm___23.4:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-1503605",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:_multilingual_engine___23.4:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-1503606",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:_oml4py___23.4:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-266118",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:*:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-1503896",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-205254",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-205265",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.10:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-205230",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.11:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-909875",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.12:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-205250",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.13:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-909872",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.14:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-909878",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.15:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-909879",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.16:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-909880",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.17:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-909876",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.18:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-220917",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.19:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-1503891",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.2:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-816314",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.20:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-816313",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.21:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-909877",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.22:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-1503897",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.23:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-205268",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.3:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-205281",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.4:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-205295",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.5:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-205256",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.6:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-205216",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.7:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-909874",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.8:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-909873",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:19.9:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-1503890",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:21.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-1503893",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:21.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-220916",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:21.10:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-611586",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:21.11:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-816312",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:21.12:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-912081",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:21.13:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-1503257",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:21.14:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-1503900",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:21.2:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-205284",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:21.3:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-1503898",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:21.4:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-1503892",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:21.5:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-1503894",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:21.6:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-1503889",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:21.7:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-1503895",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:21.8:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-1503899",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:21.9:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "database_server",
            "product": {
              "name": "database_server",
              "product_id": "CSAFPID-1503256",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:oracle:database_server:23.4:*:*:*:*:*:*:*"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "oracle"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-41881",
      "cwe": {
        "id": "CWE-674",
        "name": "Uncontrolled Recursion"
      },
      "notes": [
        {
          "category": "other",
          "text": "Uncontrolled Recursion",
          "title": "CWE-674"
        },
        {
          "category": "other",
          "text": "Improper Resource Shutdown or Release",
          "title": "CWE-404"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-266118",
          "CSAFPID-764783",
          "CSAFPID-764784",
          "CSAFPID-764785",
          "CSAFPID-764786",
          "CSAFPID-764787",
          "CSAFPID-764788",
          "CSAFPID-764789",
          "CSAFPID-764790",
          "CSAFPID-764838",
          "CSAFPID-764839",
          "CSAFPID-764840",
          "CSAFPID-764841",
          "CSAFPID-764842",
          "CSAFPID-764843",
          "CSAFPID-764844",
          "CSAFPID-764845",
          "CSAFPID-764846",
          "CSAFPID-764847",
          "CSAFPID-764848",
          "CSAFPID-1503604",
          "CSAFPID-1503605",
          "CSAFPID-1503606",
          "CSAFPID-1503607"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2022-41881",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2022/CVE-2022-41881.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-266118",
            "CSAFPID-764783",
            "CSAFPID-764784",
            "CSAFPID-764785",
            "CSAFPID-764786",
            "CSAFPID-764787",
            "CSAFPID-764788",
            "CSAFPID-764789",
            "CSAFPID-764790",
            "CSAFPID-764838",
            "CSAFPID-764839",
            "CSAFPID-764840",
            "CSAFPID-764841",
            "CSAFPID-764842",
            "CSAFPID-764843",
            "CSAFPID-764844",
            "CSAFPID-764845",
            "CSAFPID-764846",
            "CSAFPID-764847",
            "CSAFPID-764848",
            "CSAFPID-1503604",
            "CSAFPID-1503605",
            "CSAFPID-1503606",
            "CSAFPID-1503607"
          ]
        }
      ],
      "title": "CVE-2022-41881"
    },
    {
      "cve": "CVE-2024-0397",
      "product_status": {
        "known_affected": [
          "CSAFPID-266118",
          "CSAFPID-1503604",
          "CSAFPID-1503605",
          "CSAFPID-1503606",
          "CSAFPID-1503607"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-0397",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-0397.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-266118",
            "CSAFPID-1503604",
            "CSAFPID-1503605",
            "CSAFPID-1503606",
            "CSAFPID-1503607"
          ]
        }
      ],
      "title": "CVE-2024-0397"
    },
    {
      "cve": "CVE-2024-4603",
      "product_status": {
        "known_affected": [
          "CSAFPID-266118",
          "CSAFPID-1503604",
          "CSAFPID-1503605",
          "CSAFPID-1503606",
          "CSAFPID-1503607"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-4603",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-4603.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-266118",
            "CSAFPID-1503604",
            "CSAFPID-1503605",
            "CSAFPID-1503606",
            "CSAFPID-1503607"
          ]
        }
      ],
      "title": "CVE-2024-4603"
    },
    {
      "cve": "CVE-2024-21098",
      "cwe": {
        "id": "CWE-285",
        "name": "Improper Authorization"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Authorization",
          "title": "CWE-285"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-266118",
          "CSAFPID-1503604",
          "CSAFPID-1503605",
          "CSAFPID-1503606",
          "CSAFPID-1503607"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-21098",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21098.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-266118",
            "CSAFPID-1503604",
            "CSAFPID-1503605",
            "CSAFPID-1503606",
            "CSAFPID-1503607"
          ]
        }
      ],
      "title": "CVE-2024-21098"
    },
    {
      "cve": "CVE-2024-21123",
      "cwe": {
        "id": "CWE-285",
        "name": "Improper Authorization"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Authorization",
          "title": "CWE-285"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-266118",
          "CSAFPID-1503604",
          "CSAFPID-1503605",
          "CSAFPID-1503606",
          "CSAFPID-1503607"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-21123",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21123.json"
        }
      ],
      "title": "CVE-2024-21123"
    },
    {
      "cve": "CVE-2024-21126",
      "cwe": {
        "id": "CWE-404",
        "name": "Improper Resource Shutdown or Release"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Resource Shutdown or Release",
          "title": "CWE-404"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-266118",
          "CSAFPID-1503604",
          "CSAFPID-1503605",
          "CSAFPID-1503606",
          "CSAFPID-1503607"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-21126",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21126.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-266118",
            "CSAFPID-1503604",
            "CSAFPID-1503605",
            "CSAFPID-1503606",
            "CSAFPID-1503607"
          ]
        }
      ],
      "title": "CVE-2024-21126"
    },
    {
      "cve": "CVE-2024-21174",
      "product_status": {
        "known_affected": [
          "CSAFPID-266118",
          "CSAFPID-1503604",
          "CSAFPID-1503605",
          "CSAFPID-1503606",
          "CSAFPID-1503607"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-21174",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21174.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-266118",
            "CSAFPID-1503604",
            "CSAFPID-1503605",
            "CSAFPID-1503606",
            "CSAFPID-1503607"
          ]
        }
      ],
      "title": "CVE-2024-21174"
    },
    {
      "cve": "CVE-2024-21184",
      "product_status": {
        "known_affected": [
          "CSAFPID-266118",
          "CSAFPID-1503604",
          "CSAFPID-1503605",
          "CSAFPID-1503606",
          "CSAFPID-1503607"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-21184",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21184.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-266118",
            "CSAFPID-1503604",
            "CSAFPID-1503605",
            "CSAFPID-1503606",
            "CSAFPID-1503607"
          ]
        }
      ],
      "title": "CVE-2024-21184"
    }
  ]
}

CVE-2024-21126 (GCVE-0-2024-21126)

Vulnerability from cvelistv5 – Published: 2024-07-16 22:39 – Updated: 2024-08-29 19:26

Summary

Vulnerability in the Oracle Database Portable Clusterware component of Oracle Database Server. Supported versions that are affected are 19.3-19.23 and 21.3-21.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via DNS to compromise Oracle Database Portable Clusterware. While the vulnerability is in Oracle Database Portable Clusterware, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Database Portable Clusterware. CVSS 3.1 Base Score 5.8 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L).

Severity ?

5.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

CWE

Easily exploitable vulnerability allows unauthenticated attacker with network access via DNS to compromise Oracle Database Portable Clusterware. While the vulnerability is in Oracle Database Portable Clusterware, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Database Portable Clusterware.

Assigner

oracle

References

URL

Tags

https://www.oracle.com/security-alerts/cpujul2024.html

vendor-advisory

Impacted products

	Vendor	Product	Version
	Oracle Corporation	Database - Enterprise Edition	Affected: 19.3 , ≤ 19.23 (custom) Affected: 21.3 , ≤ 21.14 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:13:42.700Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Oracle Advisory",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2024.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:oracle:database:-:*:*:*:enterprise:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "database",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "21.14",
                "status": "affected",
                "version": "21.3",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "19.23",
                "status": "affected",
                "version": "19.3",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21126",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-05T17:45:10.937095Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-29T19:26:29.803Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Database - Enterprise Edition",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "lessThanOrEqual": "19.23",
              "status": "affected",
              "version": "19.3",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "21.14",
              "status": "affected",
              "version": "21.3",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the Oracle Database Portable Clusterware component of Oracle Database Server.  Supported versions that are affected are 19.3-19.23 and  21.3-21.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via DNS to compromise Oracle Database Portable Clusterware.  While the vulnerability is in Oracle Database Portable Clusterware, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Database Portable Clusterware. CVSS 3.1 Base Score 5.8 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via DNS to compromise Oracle Database Portable Clusterware.  While the vulnerability is in Oracle Database Portable Clusterware, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Database Portable Clusterware.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-16T22:39:52.158Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2024.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2024-21126",
    "datePublished": "2024-07-16T22:39:52.158Z",
    "dateReserved": "2023-12-07T22:28:10.681Z",
    "dateUpdated": "2024-08-29T19:26:29.803Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-0397 (GCVE-0-2024-0397)

Vulnerability from cvelistv5 – Published: 2024-06-17 15:09 – Updated: 2025-11-03 21:50

Summary

A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a certificate directory configured. This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.

Severity ?

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

CWE

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Assigner

PSF

References

URL

Tags

	https://github.com/python/cpython/issues/114572	issue-tracking
	https://github.com/python/cpython/pull/114573	patch
	https://mail.python.org/archives/list/security-an…	vendor-advisory
	https://github.com/python/cpython/commit/01c37f1d…	patch
	https://github.com/python/cpython/commit/29c97287…	patch
	https://github.com/python/cpython/commit/37324b42…	patch
	https://github.com/python/cpython/commit/542f3272…	patch
	https://github.com/python/cpython/commit/b228655c…	patch
	https://github.com/python/cpython/commit/bce69311…	patch
	http://www.openwall.com/lists/oss-security/2024/06/17/2

Impacted products

	Vendor	Product	Version
	Python Software Foundation	CPython	Affected: 0 , < 3.8.20 (python) Affected: 3.9.0 , < 3.9.20 (python) Affected: 3.10.0 , < 3.10.14 (python) Affected: 3.11.0 , < 3.11.9 (python) Affected: 3.12.0 , < 3.12.3 (python) Affected: 3.13.0a1 , < 3.13.0a5 (python)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:python_software_foundation:cpython:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "cpython",
            "vendor": "python_software_foundation",
            "versions": [
              {
                "lessThan": "3.8.20",
                "status": "affected",
                "version": "0",
                "versionType": "python"
              },
              {
                "lessThan": "3.9.20",
                "status": "affected",
                "version": "3.9.0",
                "versionType": "python"
              },
              {
                "lessThan": "3.10.14",
                "status": "affected",
                "version": "3.10.0",
                "versionType": "python"
              },
              {
                "lessThan": "3.11.9",
                "status": "affected",
                "version": "3.11.0",
                "versionType": "python"
              },
              {
                "lessThan": "3.12.3",
                "status": "affected",
                "version": "3.12.0",
                "versionType": "python"
              },
              {
                "lessThan": "3.13.0a5",
                "status": "affected",
                "version": "3.13.0a1",
                "versionType": "python"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-0397",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-20T15:52:27.499743Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-362",
                "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-17T18:24:43.948Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:50:55.091Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "issue-tracking",
              "x_transferred"
            ],
            "url": "https://github.com/python/cpython/issues/114572"
          },
          {
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/python/cpython/pull/114573"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/BMAK5BCGKYWNJOACVUSLUF6SFGBIM4VP/"
          },
          {
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/python/cpython/commit/01c37f1d0714f5822d34063ca7180b595abf589d"
          },
          {
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/python/cpython/commit/29c97287d205bf2f410f4895ebce3f43b5160524"
          },
          {
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/python/cpython/commit/37324b421b72b7bc9934e27aba85d48d4773002e"
          },
          {
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/python/cpython/commit/542f3272f56f31ed04e74c40635a913fbc12d286"
          },
          {
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/python/cpython/commit/b228655c227b2ca298a8ffac44d14ce3d22f6faa"
          },
          {
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766ab"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/06/17/2"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20250411-0006/"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CPython",
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "versions": [
            {
              "lessThan": "3.8.20",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThan": "3.9.20",
              "status": "affected",
              "version": "3.9.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.10.14",
              "status": "affected",
              "version": "3.10.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.11.9",
              "status": "affected",
              "version": "3.11.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.12.3",
              "status": "affected",
              "version": "3.12.0",
              "versionType": "python"
            },
            {
              "lessThan": "3.13.0a5",
              "status": "affected",
              "version": "3.13.0a1",
              "versionType": "python"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A defect was discovered in the Python \u201cssl\u201d module where there is a memory\nrace condition with the ssl.SSLContext methods \u201ccert_store_stats()\u201d and\n\u201cget_ca_certs()\u201d. The race condition can be triggered if the methods are\ncalled at the same time as certificates are loaded into the SSLContext,\nsuch as during the TLS handshake with a certificate directory configured.\nThis issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5."
            }
          ],
          "value": "A defect was discovered in the Python \u201cssl\u201d module where there is a memory\nrace condition with the ssl.SSLContext methods \u201ccert_store_stats()\u201d and\n\u201cget_ca_certs()\u201d. The race condition can be triggered if the methods are\ncalled at the same time as certificates are loaded into the SSLContext,\nsuch as during the TLS handshake with a certificate directory configured.\nThis issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-07T02:44:08.540Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/python/cpython/issues/114572"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/pull/114573"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/BMAK5BCGKYWNJOACVUSLUF6SFGBIM4VP/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/01c37f1d0714f5822d34063ca7180b595abf589d"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/29c97287d205bf2f410f4895ebce3f43b5160524"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/37324b421b72b7bc9934e27aba85d48d4773002e"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/542f3272f56f31ed04e74c40635a913fbc12d286"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/b228655c227b2ca298a8ffac44d14ce3d22f6faa"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766ab"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2024/06/17/2"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Memory race condition in ssl.SSLContext certificate store methods",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2024-0397",
    "datePublished": "2024-06-17T15:09:40.896Z",
    "dateReserved": "2024-01-10T14:05:31.635Z",
    "dateUpdated": "2025-11-03T21:50:55.091Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-21098 (GCVE-0-2024-21098)

Vulnerability from cvelistv5 – Published: 2024-04-16 21:26 – Updated: 2024-11-15 19:11

Summary

Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

Severity ?

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE

Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.

Assigner

oracle

References

URL

Tags

https://www.oracle.com/security-alerts/cpuapr2024.html

vendor-advisory

Impacted products

	Vendor	Product	Version
	Oracle Corporation	GraalVM	Affected: Oracle GraalVM for JDK:17.0.10 Affected: Oracle GraalVM for JDK:21.0.2 Affected: Oracle GraalVM for JDK:22 Affected: Oracle GraalVM Enterprise Edition:20.3.13 Affected: Oracle GraalVM Enterprise Edition:21.3.9 cpe:2.3:a:oracle:graalvm_for_jdk:17.0.10:::::::* cpe:2.3:a:oracle:graalvm_for_jdk:21.0.2:::::::* cpe:2.3:a:oracle:graalvm_for_jdk:22:::::::* cpe:2.3:a:oracle:graalvm:20.3.13::::enterprise::: cpe:2.3:a:oracle:graalvm:21.3.9::::enterprise:::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21098",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-15T19:21:01.904883Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-15T19:11:30.338Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:13:42.661Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Oracle Advisory",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2024.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:oracle:graalvm_for_jdk:17.0.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:graalvm_for_jdk:21.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:graalvm_for_jdk:22:*:*:*:*:*:*:*",
            "cpe:2.3:a:oracle:graalvm:20.3.13:*:*:*:enterprise:*:*:*",
            "cpe:2.3:a:oracle:graalvm:21.3.9:*:*:*:enterprise:*:*:*"
          ],
          "product": "GraalVM",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Oracle GraalVM for JDK:17.0.10"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM for JDK:21.0.2"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM for JDK:22"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.13"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.3.9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Compiler).  Supported versions that are affected are Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and  21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. CVSS 3.1 Base Score 3.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-16T21:26:31.636Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2024.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2024-21098",
    "datePublished": "2024-04-16T21:26:31.636Z",
    "dateReserved": "2023-12-07T22:28:10.675Z",
    "dateUpdated": "2024-11-15T19:11:30.338Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-21184 (GCVE-0-2024-21184)

Vulnerability from cvelistv5 – Published: 2024-07-16 22:40 – Updated: 2024-08-01 22:13

Summary

Vulnerability in the Oracle Database RDBMS Security component of Oracle Database Server. Supported versions that are affected are 19.3-19.23. Easily exploitable vulnerability allows high privileged attacker having Execute on SYS.XS_DIAG privilege with network access via Oracle Net to compromise Oracle Database RDBMS Security. Successful attacks of this vulnerability can result in takeover of Oracle Database RDBMS Security. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Severity ?

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE

Easily exploitable vulnerability allows high privileged attacker having Execute on SYS.XS_DIAG privilege with network access via Oracle Net to compromise Oracle Database RDBMS Security. Successful attacks of this vulnerability can result in takeover of Oracle Database RDBMS Security.

Assigner

oracle

References

URL

Tags

https://www.oracle.com/security-alerts/cpujul2024.html

vendor-advisory

Impacted products

	Vendor	Product	Version
	Oracle Corporation	Database - Enterprise Edition	Affected: 19.3 , ≤ 19.23 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:oracle:database_server:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "database_server",
            "vendor": "oracle",
            "versions": [
              {
                "lessThanOrEqual": "19.3",
                "status": "affected",
                "version": "19.23",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21184",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-18T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-250",
                "description": "CWE-250 Execution with Unnecessary Privileges",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-19T03:55:40.559Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:13:42.829Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Oracle Advisory",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2024.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Database - Enterprise Edition",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "lessThanOrEqual": "19.23",
              "status": "affected",
              "version": "19.3",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the Oracle Database RDBMS Security component of Oracle Database Server.  Supported versions that are affected are 19.3-19.23. Easily exploitable vulnerability allows high privileged attacker having Execute on SYS.XS_DIAG privilege with network access via Oracle Net to compromise Oracle Database RDBMS Security.  Successful attacks of this vulnerability can result in takeover of Oracle Database RDBMS Security. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows high privileged attacker having Execute on SYS.XS_DIAG privilege with network access via Oracle Net to compromise Oracle Database RDBMS Security.  Successful attacks of this vulnerability can result in takeover of Oracle Database RDBMS Security.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-16T22:40:11.681Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2024.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2024-21184",
    "datePublished": "2024-07-16T22:40:11.681Z",
    "dateReserved": "2023-12-07T22:28:10.688Z",
    "dateUpdated": "2024-08-01T22:13:42.829Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-21123 (GCVE-0-2024-21123)

Vulnerability from cvelistv5 – Published: 2024-07-16 22:39 – Updated: 2024-11-05 16:36

Summary

Vulnerability in the Oracle Database Core component of Oracle Database Server. Supported versions that are affected are 19.3-19.23. Easily exploitable vulnerability allows high privileged attacker having SYSDBA privilege with logon to the infrastructure where Oracle Database Core executes to compromise Oracle Database Core. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Database Core accessible data. CVSS 3.1 Base Score 2.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N).

Severity ?

2.3 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

CWE

Easily exploitable vulnerability allows high privileged attacker having SYSDBA privilege with logon to the infrastructure where Oracle Database Core executes to compromise Oracle Database Core. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Database Core accessible data.

Assigner

oracle

References

URL

Tags

https://www.oracle.com/security-alerts/cpujul2024.html

vendor-advisory

Impacted products

	Vendor	Product	Version
	Oracle Corporation	Database - Enterprise Edition	Affected: 19.3 , ≤ 19.23 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21123",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-17T14:53:03.011202Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-276",
                "description": "CWE-276 Incorrect Default Permissions",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-05T16:36:46.928Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:13:42.680Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Oracle Advisory",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2024.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Database - Enterprise Edition",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "lessThanOrEqual": "19.23",
              "status": "affected",
              "version": "19.3",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the Oracle Database Core component of Oracle Database Server.  Supported versions that are affected are 19.3-19.23. Easily exploitable vulnerability allows high privileged attacker having SYSDBA privilege with logon to the infrastructure where Oracle Database Core executes to compromise Oracle Database Core.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Database Core accessible data. CVSS 3.1 Base Score 2.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows high privileged attacker having SYSDBA privilege with logon to the infrastructure where Oracle Database Core executes to compromise Oracle Database Core.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Database Core accessible data.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-16T22:39:45.449Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2024.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2024-21123",
    "datePublished": "2024-07-16T22:39:45.449Z",
    "dateReserved": "2023-12-07T22:28:10.681Z",
    "dateUpdated": "2024-11-05T16:36:46.928Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-21174 (GCVE-0-2024-21174)

Vulnerability from cvelistv5 – Published: 2024-07-16 22:40 – Updated: 2024-12-03 19:45

Summary

Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.23, 21.3-21.14 and 23.4. Difficult to exploit vulnerability allows low privileged attacker having Create Session, Create Procedure privilege with network access via Oracle Net to compromise Java VM. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java VM. CVSS 3.1 Base Score 3.1 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L).

Severity ?

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

CWE

Difficult to exploit vulnerability allows low privileged attacker having Create Session, Create Procedure privilege with network access via Oracle Net to compromise Java VM. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java VM.

Assigner

oracle

References

URL

Tags

https://www.oracle.com/security-alerts/cpujul2024.html

vendor-advisory

Impacted products

	Vendor	Product	Version
	Oracle Corporation	Database - Enterprise Edition	Affected: 19.3 , ≤ 19.23 (custom) Affected: 21.3 , ≤ 21.14 (custom) Affected: 23.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21174",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-17T19:03:33.845758Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-03T19:45:28.521Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:13:42.691Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Oracle Advisory",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2024.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Database - Enterprise Edition",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "lessThanOrEqual": "19.23",
              "status": "affected",
              "version": "19.3",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "21.14",
              "status": "affected",
              "version": "21.3",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "23.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the Java VM component of Oracle Database Server.  Supported versions that are affected are 19.3-19.23, 21.3-21.14 and  23.4. Difficult to exploit vulnerability allows low privileged attacker having Create Session, Create Procedure privilege with network access via Oracle Net to compromise Java VM.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java VM. CVSS 3.1 Base Score 3.1 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows low privileged attacker having Create Session, Create Procedure privilege with network access via Oracle Net to compromise Java VM.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java VM.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-16T22:40:08.322Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2024.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2024-21174",
    "datePublished": "2024-07-16T22:40:08.322Z",
    "dateReserved": "2023-12-07T22:28:10.687Z",
    "dateUpdated": "2024-12-03T19:45:28.521Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-4603 (GCVE-0-2024-4603)

Vulnerability from cvelistv5 – Published: 2024-05-16 15:21 – Updated: 2024-10-14 14:56

Summary

Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the functions EVP_PKEY_param_check() or EVP_PKEY_public_check() to check a DSA public key or DSA parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform various checks on DSA parameters. Some of those computations take a long time if the modulus (`p` parameter) is too large. Trying to use a very large modulus is slow and OpenSSL will not allow using public keys with a modulus which is over 10,000 bits in length for signature verification. However the key and parameter check functions do not limit the modulus size when performing the checks. An application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. These functions are not called by OpenSSL itself on untrusted DSA keys so only applications that directly call these functions may be vulnerable. Also vulnerable are the OpenSSL pkey and pkeyparam command line applications when using the `-check` option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.

Severity ?

No CVSS data available.

CWE

CWE-606 - Unchecked Input for Loop Condition

Assigner

openssl

References

URL

Tags

	https://www.openssl.org/news/secadv/20240516.txt	vendor-advisory
	https://github.com/openssl/openssl/commit/3559e86…	patch
	https://github.com/openssl/openssl/commit/9c39b38…	patch
	https://github.com/openssl/openssl/commit/da343d0…	patch
	https://github.com/openssl/openssl/commit/53ea064…	patch

Impacted products

	Vendor	Product	Version
	OpenSSL	OpenSSL	Affected: 3.0.0 , < 3.0.14 (semver) Affected: 3.1.0 , < 3.1.6 (semver) Affected: 3.2.0 , < 3.2.2 (semver) Affected: 3.3.0 , < 3.3.1 (semver)

Credits

OSS-Fuzz Tomas Mraz

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T20:47:41.528Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "OpenSSL Advisory",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.openssl.org/news/secadv/20240516.txt"
          },
          {
            "name": "3.0.14 git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/openssl/openssl/commit/3559e868e58005d15c6013a0c1fd832e51c73397"
          },
          {
            "name": "3.1.6 git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/openssl/openssl/commit/9c39b3858091c152f52513c066ff2c5a47969f0d"
          },
          {
            "name": "3.2.2 git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/openssl/openssl/commit/da343d0605c826ef197aceedc67e8e04f065f740"
          },
          {
            "name": "3.3.1 git commit",
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/openssl/openssl/commit/53ea06486d296b890d565fb971b2764fcd826e7e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/05/16/2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240621-0001/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "openssl",
            "vendor": "openssl",
            "versions": [
              {
                "lessThan": "3.0.14",
                "status": "affected",
                "version": "3.0.0",
                "versionType": "semver"
              },
              {
                "lessThan": "3.1.6",
                "status": "affected",
                "version": "3.1.0",
                "versionType": "semver"
              },
              {
                "lessThan": "3.2.2",
                "status": "affected",
                "version": "3.2.0",
                "versionType": "semver"
              },
              {
                "lessThan": "3.3.1",
                "status": "affected",
                "version": "3.3.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-4603",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-16T18:27:25.638098Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-834",
                "description": "CWE-834 Excessive Iteration",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-13T15:11:57.009Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "lessThan": "3.0.14",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.1.6",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.2.2",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.3.1",
              "status": "affected",
              "version": "3.3.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "OSS-Fuzz"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Tomas Mraz"
        }
      ],
      "datePublic": "2024-05-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Issue summary: Checking excessively long DSA keys or parameters may be very\u003cbr\u003eslow.\u003cbr\u003e\u003cbr\u003eImpact summary: Applications that use the functions EVP_PKEY_param_check()\u003cbr\u003eor EVP_PKEY_public_check() to check a DSA public key or DSA parameters may\u003cbr\u003eexperience long delays. Where the key or parameters that are being checked\u003cbr\u003ehave been obtained from an untrusted source this may lead to a Denial of\u003cbr\u003eService.\u003cbr\u003e\u003cbr\u003eThe functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform\u003cbr\u003evarious checks on DSA parameters. Some of those computations take a long time\u003cbr\u003eif the modulus (`p` parameter) is too large.\u003cbr\u003e\u003cbr\u003eTrying to use a very large modulus is slow and OpenSSL will not allow using\u003cbr\u003epublic keys with a modulus which is over 10,000 bits in length for signature\u003cbr\u003everification. However the key and parameter check functions do not limit\u003cbr\u003ethe modulus size when performing the checks.\u003cbr\u003e\u003cbr\u003eAn application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check()\u003cbr\u003eand supplies a key or parameters obtained from an untrusted source could be\u003cbr\u003evulnerable to a Denial of Service attack.\u003cbr\u003e\u003cbr\u003eThese functions are not called by OpenSSL itself on untrusted DSA keys so\u003cbr\u003eonly applications that directly call these functions may be vulnerable.\u003cbr\u003e\u003cbr\u003eAlso vulnerable are the OpenSSL pkey and pkeyparam command line applications\u003cbr\u003ewhen using the `-check` option.\u003cbr\u003e\u003cbr\u003eThe OpenSSL SSL/TLS implementation is not affected by this issue.\u003cbr\u003e\u003cbr\u003eThe OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue."
            }
          ],
          "value": "Issue summary: Checking excessively long DSA keys or parameters may be very\nslow.\n\nImpact summary: Applications that use the functions EVP_PKEY_param_check()\nor EVP_PKEY_public_check() to check a DSA public key or DSA parameters may\nexperience long delays. Where the key or parameters that are being checked\nhave been obtained from an untrusted source this may lead to a Denial of\nService.\n\nThe functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform\nvarious checks on DSA parameters. Some of those computations take a long time\nif the modulus (`p` parameter) is too large.\n\nTrying to use a very large modulus is slow and OpenSSL will not allow using\npublic keys with a modulus which is over 10,000 bits in length for signature\nverification. However the key and parameter check functions do not limit\nthe modulus size when performing the checks.\n\nAn application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check()\nand supplies a key or parameters obtained from an untrusted source could be\nvulnerable to a Denial of Service attack.\n\nThese functions are not called by OpenSSL itself on untrusted DSA keys so\nonly applications that directly call these functions may be vulnerable.\n\nAlso vulnerable are the OpenSSL pkey and pkeyparam command line applications\nwhen using the `-check` option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue."
        }
      ],
      "metrics": [
        {
          "format": "other",
          "other": {
            "content": {
              "text": "Low"
            },
            "type": "https://www.openssl.org/policies/secpolicy.html"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-606",
              "description": "CWE-606 Unchecked Input for Loop Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-14T14:56:01.784Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "name": "OpenSSL Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.openssl.org/news/secadv/20240516.txt"
        },
        {
          "name": "3.0.14 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/3559e868e58005d15c6013a0c1fd832e51c73397"
        },
        {
          "name": "3.1.6 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/9c39b3858091c152f52513c066ff2c5a47969f0d"
        },
        {
          "name": "3.2.2 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/da343d0605c826ef197aceedc67e8e04f065f740"
        },
        {
          "name": "3.3.1 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/53ea06486d296b890d565fb971b2764fcd826e7e"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Excessive time spent checking DSA keys and parameters",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2024-4603",
    "datePublished": "2024-05-16T15:21:20.050Z",
    "dateReserved": "2024-05-07T11:44:02.196Z",
    "dateUpdated": "2024-10-14T14:56:01.784Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-41881 (GCVE-0-2022-41881)

Vulnerability from cvelistv5 – Published: 2022-12-12 00:00 – Updated: 2025-04-22 15:57

Summary

Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion. This issue is patched in version 4.1.86.Final. There is no workaround, except using a custom HaProxyMessageDecoder.

Severity ?

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE

CWE-674 - Uncontrolled Recursion

Assigner

GitHub_M

References

URL

Tags

	https://github.com/netty/netty/security/advisorie…
	https://lists.debian.org/debian-lts-announce/2023…	mailing-list
	https://www.debian.org/security/2023/dsa-5316	vendor-advisory
	https://security.netapp.com/advisory/ntap-2023011…

Impacted products

	Vendor	Product	Version
	netty	netty	Affected: < 4.1.86.Final

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T12:56:38.229Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/netty/netty/security/advisories/GHSA-fx2c-96vj-985v"
          },
          {
            "name": "[debian-lts-announce] 20230111 [SECURITY] [DLA 3268-1] netty security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html"
          },
          {
            "name": "DSA-5316",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5316"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230113-0004/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-41881",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-22T15:39:04.984423Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-22T15:57:46.309Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "netty",
          "vendor": "netty",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.1.86.Final"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion. This issue is patched in version 4.1.86.Final. There is no workaround, except using a custom HaProxyMessageDecoder."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-13T00:00:00.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "url": "https://github.com/netty/netty/security/advisories/GHSA-fx2c-96vj-985v"
        },
        {
          "name": "[debian-lts-announce] 20230111 [SECURITY] [DLA 3268-1] netty security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html"
        },
        {
          "name": "DSA-5316",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2023/dsa-5316"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230113-0004/"
        }
      ],
      "source": {
        "advisory": "GHSA-fx2c-96vj-985v",
        "discovery": "UNKNOWN"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-41881",
    "datePublished": "2022-12-12T00:00:00.000Z",
    "dateReserved": "2022-09-30T00:00:00.000Z",
    "dateUpdated": "2025-04-22T15:57:46.309Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

NCSC-2024-0291

CVE-2024-21126 (GCVE-0-2024-21126)

CVE-2024-0397 (GCVE-0-2024-0397)

CVE-2024-21098 (GCVE-0-2024-21098)

CVE-2024-21184 (GCVE-0-2024-21184)

CVE-2024-21123 (GCVE-0-2024-21123)

CVE-2024-21174 (GCVE-0-2024-21174)

CVE-2024-4603 (GCVE-0-2024-4603)

CVE-2022-41881 (GCVE-0-2022-41881)

Tags

Sightings

Nomenclature