Improper input validation in Oracle Communications Cloud Native Core Policy - CVE-2021-3572

Vulnerability identifier: #VU62512

CSH Severity: Medium

CVSS v4: 6.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-3572

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote authenticated user to manipulate data.

The vulnerability exists due to improper input validation within the Policy (python-pip) component in Oracle Communications Cloud Native Core Policy. A remote authenticated user can exploit this vulnerability to manipulate data.

Oracle Communications Cloud Native Core Policy
Oracle Communications Cloud Native Core Network Function Cloud Native Environment
IBM Cloud Pak for Watson AIOps
Guardium Data Security Center (GDSC)
QRadar Deployment Intelligence App
PowerStore T
EMC ECS
Maximo Application Suite - IoT Component
Robotic Process Automation for Cloud Pak
PowerStore 9000X
PowerStore 7000X
PowerStore 5000X
PowerStore 3000X
PowerStore 1000X
PowerStoreX OS
Voice Gateway
Cloud Pak for Security (CP4S)
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Enterprise Storage
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for IBM z Systems
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
HPE Helion Openstack
Red Hat CodeReady Linux Builder for ARM 64
SUSE Linux Enterprise Module for Public Cloud
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Web Scripting
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Module for Python2
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise Module for Desktop Applications
SUSE Linux Enterprise Module Python3
openSUSE Leap
openEuler
IBM Watson Assistant for IBM Cloud Pak for Data
Dell Secure Connect Gateway
Netcool Operations Insight
Red Hat Advanced Cluster Management for Kubernetes
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Red Hat OpenStack
IBM Cloud Pak for Business Automation
IBM Robotic Process Automation
IBM Automation Decision Services
IBM Observability with Instana
Splunk Enterprise
Migration Toolkit for Containers
python
python-debuginfo
python-debugsource
python-tk
python-tk-debuginfo
python-curses
python-curses-debuginfo
python-gdbm
python-gdbm-debuginfo
libpython2_7-1_0-debuginfo
libpython2_7-1_0
python-devel
python-base
python-base-debuginfo
python-base-debugsource
python-xml-debuginfo
python-xml
python3-base-debuginfo
python3-base-debugsource
python3-dbm
python3-dbm-debuginfo
python3-debuginfo
python3-debugsource
python3-devel-debuginfo
libpython3_4m1_0
libpython3_4m1_0-debuginfo
python3
python3-base
python3-curses
python3-curses-debuginfo
python3-tk
python3-tk-debuginfo
libpython3_4m1_0-32bit
libpython3_4m1_0-debuginfo-32bit
python3-base-debuginfo-32bit
python3-devel
libpython3_6m1_0-debuginfo-32bit
libpython3_6m1_0
libpython3_6m1_0-debuginfo
python36-base
python36-base-debuginfo
libpython3_6m1_0-32bit
python36-devel
python36-debugsource
python36-debuginfo
python36
python3-idle
python3-tools
python3-testsuite
python3-core-debugsource
python39-doc-devhelp
python39-doc
python39-devel
python39-testsuite
python39-testsuite-debuginfo
python39-tools
libpython3_9-1_0-32bit
libpython3_9-1_0-32bit-debuginfo
libpython3_9-1_0
python39-base-32bit
python39-base-32bit-debuginfo
libpython3_9-1_0-debuginfo
python39-core-debugsource
python39-base-debuginfo
python39-base
python39-dbm-debuginfo
python39-32bit-debuginfo
python39-32bit
python39-dbm
python39
python39-tk-debuginfo
python39-tk
python39-idle
python39-curses
python39-curses-debuginfo
python39-debugsource
python39-debuginfo
python-pip
python-pip (Red Hat package)
python3-pip-wheel
python3-pip
python2-pip
python-pip-wheel
python-pip-help
python39-pip
python36-pip
Dell EMC VxRail Appliance
IBM Cognos Analytics

Install updates from vendor's website.

Voice Gateway - update to 1.0.8.12
Cloud Pak for Security (CP4S) - update to 1.10.7.0
Guardium Data Security Center (GDSC) - update to 3.6.1
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.7.0
Dell Secure Connect Gateway - update to 5.12.00.10
Splunk Enterprise - addressed in versions 8.2.12, 9.0.6, 9.1.1
Migration Toolkit for Containers - update to 1.5.4
Netcool Operations Insight - update to 1.6.11
Red Hat Advanced Cluster Management for Kubernetes - update to 2.2.10
python - update to 2.7.18-150000.38.1
python-debuginfo - update to 2.7.18-150000.38.1
python-debugsource - update to 2.7.18-150000.38.1
python-tk - update to 2.7.18-150000.38.1
python-tk-debuginfo - update to 2.7.18-150000.38.1
python-curses - update to 2.7.18-150000.38.1
python-curses-debuginfo - update to 2.7.18-150000.38.1
python-gdbm - update to 2.7.18-150000.38.1
python-gdbm-debuginfo - update to 2.7.18-150000.38.1
libpython2_7-1_0-debuginfo - update to 2.7.18-150000.38.2
libpython2_7-1_0 - update to 2.7.18-150000.38.2
python-devel - update to 2.7.18-150000.38.2
python-base - update to 2.7.18-150000.38.2
python-base-debuginfo - update to 2.7.18-150000.38.2
python-base-debugsource - update to 2.7.18-150000.38.2
python-xml-debuginfo - update to 2.7.18-150000.38.2
python-xml - update to 2.7.18-150000.38.2
QRadar Deployment Intelligence App - update to 3.0.16
PowerStoreX OS - update to 3.2.1.5-2424458
python3-base-debuginfo - addressed in versions 3.4.10-25.88.1, 3.6.15-150000.3.106.1, 3.6.15-150300.10.21.1
python3-base-debugsource - update to 3.4.10-25.88.1
python3-dbm - addressed in versions 3.4.10-25.88.1, 3.6.15-150000.3.106.1, 3.6.15-150300.10.21.1
python3-dbm-debuginfo - addressed in versions 3.4.10-25.88.1, 3.6.15-150000.3.106.1, 3.6.15-150300.10.21.1
python3-debuginfo - addressed in versions 3.4.10-25.88.1, 3.6.15-150000.3.106.1, 3.6.15-150300.10.21.1
python3-debugsource - addressed in versions 3.4.10-25.88.1, 3.6.15-150000.3.106.1, 3.6.15-150300.10.21.1
python3-devel-debuginfo - addressed in versions 3.4.10-25.88.1, 3.6.15-150000.3.106.1, 3.6.15-150300.10.21.1
libpython3_4m1_0 - update to 3.4.10-25.88.1
libpython3_4m1_0-debuginfo - update to 3.4.10-25.88.1
python3 - addressed in versions 3.4.10-25.88.1, 3.6.15-150000.3.106.1, 3.6.15-150300.10.21.1
python3-base - addressed in versions 3.4.10-25.88.1, 3.6.15-150000.3.106.1, 3.6.15-150300.10.21.1
python3-curses - addressed in versions 3.4.10-25.88.1, 3.6.15-150000.3.106.1, 3.6.15-150300.10.21.1
python3-curses-debuginfo - addressed in versions 3.4.10-25.88.1, 3.6.15-150000.3.106.1, 3.6.15-150300.10.21.1
python3-tk - addressed in versions 3.4.10-25.88.1, 3.6.15-150000.3.106.1, 3.6.15-150300.10.21.1
python3-tk-debuginfo - addressed in versions 3.4.10-25.88.1, 3.6.15-150000.3.106.1, 3.6.15-150300.10.21.1
libpython3_4m1_0-32bit - update to 3.4.10-25.88.1
libpython3_4m1_0-debuginfo-32bit - update to 3.4.10-25.88.1
python3-base-debuginfo-32bit - update to 3.4.10-25.88.1
python3-devel - addressed in versions 3.4.10-25.88.1, 3.6.15-150000.3.106.1, 3.6.15-150300.10.21.1
PowerStore T - update to 3.6.1.4-2413340
libpython3_6m1_0-debuginfo-32bit - update to 3.6.15-21.4
libpython3_6m1_0 - addressed in versions 3.6.15-21.4, 3.6.15-150000.3.106.1, 3.6.15-150300.10.21.1
libpython3_6m1_0-debuginfo - addressed in versions 3.6.15-21.4, 3.6.15-150000.3.106.1, 3.6.15-150300.10.21.1
python36-base - update to 3.6.15-21.4
python36-base-debuginfo - update to 3.6.15-21.4
libpython3_6m1_0-32bit - update to 3.6.15-21.4
python36-devel - update to 3.6.15-21.4
python36-debugsource - update to 3.6.15-21.5
python36-debuginfo - update to 3.6.15-21.5
python36 - update to 3.6.15-21.5
python3-idle - addressed in versions 3.6.15-150000.3.106.1, 3.6.15-150300.10.21.1
python3-tools - addressed in versions 3.6.15-150000.3.106.1, 3.6.15-150300.10.21.1
python3-testsuite - update to 3.6.15-150000.3.106.1
python3-core-debugsource - addressed in versions 3.6.15-150000.3.106.1, 3.6.15-150300.10.21.1
EMC ECS - update to 3.7.0.2
python39-doc-devhelp - update to 3.9.10-150300.4.8.1
python39-doc - update to 3.9.10-150300.4.8.1
python39-devel - update to 3.9.10-150300.4.8.1
python39-testsuite - update to 3.9.10-150300.4.8.1
python39-testsuite-debuginfo - update to 3.9.10-150300.4.8.1
python39-tools - update to 3.9.10-150300.4.8.1
libpython3_9-1_0-32bit - update to 3.9.10-150300.4.8.1
libpython3_9-1_0-32bit-debuginfo - update to 3.9.10-150300.4.8.1
libpython3_9-1_0 - update to 3.9.10-150300.4.8.1
python39-base-32bit - update to 3.9.10-150300.4.8.1
python39-base-32bit-debuginfo - update to 3.9.10-150300.4.8.1
libpython3_9-1_0-debuginfo - update to 3.9.10-150300.4.8.1
python39-core-debugsource - update to 3.9.10-150300.4.8.1
python39-base-debuginfo - update to 3.9.10-150300.4.8.1
python39-base - update to 3.9.10-150300.4.8.1
python39-dbm-debuginfo - update to 3.9.10-150300.4.8.2
python39-32bit-debuginfo - update to 3.9.10-150300.4.8.2
python39-32bit - update to 3.9.10-150300.4.8.2
python39-dbm - update to 3.9.10-150300.4.8.2
python39 - update to 3.9.10-150300.4.8.2
python39-tk-debuginfo - update to 3.9.10-150300.4.8.2
python39-tk - update to 3.9.10-150300.4.8.2
python39-idle - update to 3.9.10-150300.4.8.2
python39-curses - update to 3.9.10-150300.4.8.2
python39-curses-debuginfo - update to 3.9.10-150300.4.8.2
python39-debugsource - update to 3.9.10-150300.4.8.2
python39-debuginfo - update to 3.9.10-150300.4.8.2
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.0.3
Dell EMC VxRail Appliance - update to 8.0.000
Maximo Application Suite - IoT Component - addressed in versions 8.7.21, 8.8.17, 9.0.7
python-pip - addressed in versions 9.0.1-3.6.1, 9.0.1-4.6.1, 10.0.1-13.6.1
python-pip (Red Hat package) - update to 9.0.3-20.el8
python3-pip-wheel - update to 10.0.1-3.9.1
python3-pip - addressed in versions 10.0.1-13.6.1, 20.0.2-6.15.1
IBM Cognos Analytics - addressed in versions 11.1.7 Fix Pack 8, 11.2.4 FP3, 12.0.2
Red Hat OpenStack - update to 16.2
python2-pip - update to 20.0.2-6.15.1
python2-pip - addressed in versions 20.2.2-2, 20.2.2-9, 20.2.2-13, 20.2.2-19
python-pip-wheel - addressed in versions 20.2.2-2, 20.2.2-9, 20.2.2-13, 20.2.2-19, 21.3.1-6, 21.3.1-8, 21.3.1-12, 21.3.1-18, 23.3.1-2
python-pip - addressed in versions 20.2.2-2, 20.2.2-9, 20.2.2-13, 20.2.2-19, 21.3.1-6, 21.3.1-8, 21.3.1-12, 21.3.1-18, 23.3.1-2
python3-pip - addressed in versions 20.2.2-2, 20.2.2-9, 20.2.2-13, 20.2.2-19, 21.3.1-6, 21.3.1-8, 21.3.1-12, 21.3.1-18, 23.3.1-2
python-pip-help - addressed in versions 20.2.2-2, 20.2.2-9, 20.2.2-13, 20.2.2-19, 21.3.1-6, 21.3.1-8, 21.3.1-12, 21.3.1-18, 23.3.1-2
python39-pip - update to 20.2.4-7.8.1
python36-pip - update to 20.2.4-8.9.1
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF034, 23.0.2-IF006
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.19, 23.0.19
IBM Robotic Process Automation - addressed in versions 21.0.7.19, 23.0.19
IBM Automation Decision Services - update to 23.0.2.0.5
IBM Observability with Instana - update to 277

• https://www.oracle.com/security-alerts/cpuapr2022.html

• Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Function Cloud Native Environment
• SUSE update for python-pip
• SUSE update for python-pip
• SUSE update for python-pip
• SUSE update for python-pip
• SUSE update for python-pip
• SUSE update for python36-pip
• SUSE update for python39-pip
• SUSE update for python3
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
• Multiple vulnerabilities in DELL Secure Connect Gateway Security
• Multiple vulnerabilities in Dell Elastic Cloud Storage (ECS)
• Multiple vulnerabilities in Dell VxRail Appliance components
• Red Hat Enterprise Linux 8 update for python-pip
• SUSE update for python3
• SUSE update for python3
• SUSE update for python
• SUSE update for python36
• SUSE update for python3
• SUSE update for python39
• Multiple vulnerabilities in IBM Watson Assistant for IBM Cloud Pak for Data
• Splunk Enterprise update for third-party packages
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Multiple vulnerabilities in IBM Netcool Operations Insight
• Multiple vulnerabilities in IBM Cognos Analytics
• openEuler update for python-pip
• Multiple vulnerabilities in IBM Automation Decision Services
• openEuler 24.03 LTS update for python-pip
• openEuler 22.03 LTS SP4 update for python-pip
• openEuler 22.03 LTS SP1 update for python-pip
• openEuler 22.03 LTS SP3 update for python-pip
• openEuler 20.03 LTS SP4 update for python-pip
• Multiple vulnerabilities in IBM Observability with Instana
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Robotic Process Automation
• Red Hat Enterprise Linux 8 update for the python39:3.9 and python39-devel:3.9 modules
• Red Hat Enterprise Linux 8 update for the python38:3.8 and python38-devel:3.8 modules
• Multiple vulnerabilities in Red Hat OpenStack 16.2 packages
• Multiple vulnerabilities in Migration Toolkit for Containers 1.5
• Multiple vulnerabilities in Dell PowerStore T
• Multiple vulnerabilities in Guardium Data Security Center
• Multiple vulnerabilities in IBM QRadar Deployment Intelligence App
• Multiple vulnerabilities in IBM Maximo Application Suite - IoT Component
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM Voice Gateway
• Multiple vulnerabilities in Dell PowerStore X
• openEuler 20.03 LTS SP4 update for python-pip
• openEuler 22.03 LTS SP4 update for python-pip
• openEuler 22.03 LTS SP3 update for python-pip
• openEuler 22.03 LTS SP4 update for python-pip
• openEuler 20.03 LTS SP4 update for python-pip
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.2