Multiple vulnerabilities in Oracle Communications Cloud Native Core Unified Data Repository



Published: 2022-10-18
Risk High
Patch available YES
Number of vulnerabilities 5
CVE-ID CVE-2022-32206
CVE-2022-2191
CVE-2022-25857
CVE-2022-1586
CVE-2022-23218
CWE-ID CWE-400
CWE-401
CWE-125
CWE-119
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
Oracle Communications Cloud Native Core Unified Data Repository
Server applications / DLP, anti-spam, sniffers

Vendor Oracle

Security Bulletin

This security bulletin contains information about 5 vulnerabilities.

1) Resource exhaustion

EUVDB-ID: #VU64682

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-32206

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insecure processing of compressed HTTP responses. A malicious server can send a specially crafted HTTP response to curl and perform a denial of service attack by forcing curl to spend enormous amounts of allocated heap memory, or trying to and returning out of memory errors.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Oracle Communications Cloud Native Core Unified Data Repository: 22.3.0


CPE2.3 External links

http://www.oracle.com/security-alerts/cpuoct2022.html?936690

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

2) Memory leak

EUVDB-ID: #VU65832

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-2191

CWE-ID: CWE-401 - Improper Release of Memory Before Removing Last Reference ('Memory Leak')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak when handling incorrect TLS connections. A remote attacker can force the application to leak memory and perform denial of service attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Oracle Communications Cloud Native Core Unified Data Repository: 22.3.0


CPE2.3 External links

http://www.oracle.com/security-alerts/cpuoct2022.html?936690

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

3) Resource exhaustion

EUVDB-ID: #VU67665

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-25857

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when handling YAML files. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Oracle Communications Cloud Native Core Unified Data Repository: 22.2.1 - 22.3.0


CPE2.3 External links

http://www.oracle.com/security-alerts/cpuoct2022.html?936690

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

4) Out-of-bounds read

EUVDB-ID: #VU63945

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2022-1586

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to a boundary condition in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. A remote attacker can pass specially crafted data to the application, trigger out-of-bounds read error, gain access to sensitive information or perform a denial of service attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Oracle Communications Cloud Native Core Unified Data Repository: 22.3.0


CPE2.3 External links

http://www.oracle.com/security-alerts/cpuoct2022.html?936690

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

5) Buffer overflow

EUVDB-ID: #VU61294

Risk: High

CVSSv3.1:

CVE-ID: CVE-2022-23218

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the svcunix_create() in the sunrpc module ib glibc. A remote attacker can pass specially crafted input to the application that is using the affected library version, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Oracle Communications Cloud Native Core Unified Data Repository: 22.1.1


CPE2.3 External links

http://www.oracle.com/security-alerts/cpuoct2022.html?936690

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###