Improper input validation in Oracle Communications Converged Application Server - CVE-2020-27218

Vulnerability identifier: #VU52502

CSH Severity: Medium

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-27218

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to manipulate or delete data.

The vulnerability exists due to improper input validation within the SC Admin server (Eclipse Jetty) component in Oracle Communications Converged Application Server - Service Controller. A remote non-authenticated attacker can exploit this vulnerability to manipulate or delete data.

Oracle Communications Converged Application Server
AMQ Broker
Fuse
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
cri-o (Red Hat package)
jenkins (Red Hat package)
python-requests (Red Hat package)
atomic-openshift (Red Hat package)
openshift-ansible (Red Hat package)
atomic-openshift-cluster-autoscaler (Red Hat package)
golang-github-prometheus-alertmanager (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
atomic-openshift-metrics-server (Red Hat package)
atomic-openshift-node-problem-detector (Red Hat package)
openshift-enterprise-autoheal (Red Hat package)
atomic-openshift-web-console (Red Hat package)
atomic-openshift-descheduler (Red Hat package)
openshift-enterprise-cluster-capacity (Red Hat package)
golang-github-openshift-oauth-proxy (Red Hat package)
golang-github-prometheus-node_exporter (Red Hat package)
atomic-enterprise-service-catalog (Red Hat package)
golang-github-prometheus-prometheus (Red Hat package)
atomic-openshift-dockerregistry (Red Hat package)
openshift-kuryr (Red Hat package)
jenkins-2-plugins (Red Hat package)
openshift (Red Hat package)
machine-config-daemon (Red Hat package)
openshift-clients (Red Hat package)
Oracle Communications Services Gatekeeper
Oracle FLEXCUBE Private Banking
StreamSets Data Collector
Dell Security Management Server
Oracle Retail EFTLink
IBM Process Mining
Unified Mediation Bus
Oracle Blockchain Platform
Operational Decision Manager
IBM Cognos Command Center

Install updates from vendor's website.

Migration Toolkit for Containers - update to 1.4.6
cri-o (Red Hat package) - addressed in versions 1.19.2-6.rhaos4.6.git686e6d9.el7, 1.19.2-6.rhaos4.6.git686e6d9.el8
jenkins (Red Hat package) - addressed in versions 2.277.3.1623846768-1.el7, 2.277.3.1623853726-1.el8, 2.289.1.1624365627-1.el7
python-requests (Red Hat package) - update to 2.19.1-5.el7
Red Hat OpenShift Container Platform - addressed in versions 3.11.462, 4.5.41, 4.6.36
atomic-openshift (Red Hat package) - update to 3.11.462-1.git.0.e7d0362.el7
openshift-ansible (Red Hat package) - addressed in versions 3.11.462-1.git.0.53e69e6.el7, 4.5.0-202106011407.p0.git.83db419.el7
atomic-openshift-cluster-autoscaler (Red Hat package) - update to 3.11.462-1.git.99b2acf.el7
golang-github-prometheus-alertmanager (Red Hat package) - update to 3.11.462-1.git.13de638.el7
atomic-openshift-service-idler (Red Hat package) - addressed in versions 3.11.462-1.git.39cfc66.el7, 4.5.0-202106011407.p0.git.39cfc66.el7
atomic-openshift-metrics-server (Red Hat package) - update to 3.11.462-1.git.f8bf728.el7
atomic-openshift-node-problem-detector (Red Hat package) - update to 3.11.462-1.git.c8f26da.el7
openshift-enterprise-autoheal (Red Hat package) - update to 3.11.462-1.git.f2f435d.el7
atomic-openshift-web-console (Red Hat package) - update to 3.11.462-1.git.656f5d6.el7
atomic-openshift-descheduler (Red Hat package) - update to 3.11.462-1.git.d435537.el7
openshift-enterprise-cluster-capacity (Red Hat package) - update to 3.11.462-1.git.22be164.el7
golang-github-openshift-oauth-proxy (Red Hat package) - update to 3.11.462-1.git.edebe84.el7
golang-github-prometheus-node_exporter (Red Hat package) - update to 3.11.462-1.git.609cd20.el7
atomic-enterprise-service-catalog (Red Hat package) - update to 3.11.462-1.git.2e6be86.el7
golang-github-prometheus-prometheus (Red Hat package) - update to 3.11.462-1.git.99aae51.el7
atomic-openshift-dockerregistry (Red Hat package) - update to 3.11.462-1.git.3571208.el7
openshift-kuryr (Red Hat package) - addressed in versions 3.11.462-1.git.c33a657.el7, 4.5.0-202106011407.p0.git.75cc301.el8, 4.6.0-202106181055.p0.git.7feb5bd.el8
jenkins-2-plugins (Red Hat package) - addressed in versions 3.11.1624366838-1.el7, 4.5.1623326336-1.el7
openshift (Red Hat package) - addressed in versions 4.5.0-202106011407.p0.git.d8ef5ad.el7, 4.5.0-202106011407.p0.git.d8ef5ad.el8
machine-config-daemon (Red Hat package) - update to 4.5.0-202106011407.p0.git.f003424.el8
openshift-clients (Red Hat package) - addressed in versions 4.5.0-202106011407.p0.git.297a4ac.el7, 4.5.0-202106011407.p0.git.297a4ac.el8, 4.6.0-202106160917.p0.git.99556b6.el7, 4.6.0-202106160917.p0.git.99556b6.el8
IBM Process Mining - update to 1.12.0.4
Unified Mediation Bus - update to 4.4
StreamSets Data Collector - update to 7.0.0
AMQ Broker - addressed in versions 7.4.6, 7.8.1
Fuse - update to 7.10.0
Operational Decision Manager - addressed in versions 8.10.5.2 Interim fix 1, 8.11.0.1 Interim fix 30, 8.11.1 Interim fix 24, 8.12.0.1 Interim fix 5
IBM Cognos Command Center - update to 10.2.4 Fix Pack 1 IF17
Dell Security Management Server - update to 11.1.1
Oracle Blockchain Platform - update to 21.1.2

• https://www.oracle.com/security-alerts/cpuapr2021.html

• Improper input validation in Oracle Communications Converged Application Server - Service Controller
• Multiple vulnerabilities in Oracle Retail EFTLink
• Multiple vulnerabilities in OpenShift Container Platform
• Multiple vulnerabilities in OpenShift Container Platform 3.11
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.5
• Multiple vulnerabilities in Oracle Communications Services Gatekeeper
• Multiple vulnerabilities in Oracle FLEXCUBE Private Banking
• Multiple vulnerabilities in Red Hat Migration Toolkit for Containers
• Multiple vulnerabilities in Oracle Blockchain Platform
• Multiple vulnerabilities in Dell Security Management Server
• Multiple vulnerabilities in IBM Process Mining
• Multiple vulnerabilities in IBM Cognos Command Center
• Multiple vulnerabilities in HPE Unified Mediation Bus (UMB)
• Multiple vulnerabilities in IBM Operational Decision Manager
• Multiple vulnerabilities in AMQ Broker 7.4
• Multiple vulnerabilities in AMQ Broker 7.8
• Multiple vulnerabilities in Fuse 7.10
• Multiple vulnerabilities in IBM StreamSets Data Collector