Improper input validation in Oracle Communications Cloud Native Core Network Data Analytics Function - CVE-2023-6507

Vulnerability identifier: #VU88577

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-6507

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote privileged user to manipulate data.

The vulnerability exists due to improper input validation within the Third Party (Python) component in Oracle Communications Cloud Native Core Network Data Analytics Function. A remote privileged user can exploit this vulnerability to manipulate data.

Oracle Communications Cloud Native Core Network Data Analytics Function
Gentoo Linux
Ubuntu
python3.8 (Ubuntu package)
python3.5-minimal (Ubuntu package)
python3.5 (Ubuntu package)
python3.7-minimal (Ubuntu package)
python3.7 (Ubuntu package)
python3.6-minimal (Ubuntu package)
python3.6 (Ubuntu package)
python3.9-minimal (Ubuntu package)
python3.9 (Ubuntu package)
python3.8-minimal (Ubuntu package)
python3.11-minimal (Ubuntu package)
python3.11 (Ubuntu package)
python3.10-minimal (Ubuntu package)
python3.10 (Ubuntu package)
python3.12-minimal (Ubuntu package)
python3.12 (Ubuntu package)
dev-lang/python
dev-python/pypy3

Install updates from vendor's website.

python3.8 (Ubuntu package) - addressed in versions Ubuntu Pro, 3.8.10-0ubuntu1~20.04.10
python3.5-minimal (Ubuntu package) - update to Ubuntu Pro
python3.5 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
python3.7-minimal (Ubuntu package) - update to Ubuntu Pro
python3.7 (Ubuntu package) - update to Ubuntu Pro
python3.6-minimal (Ubuntu package) - update to Ubuntu Pro
python3.6 (Ubuntu package) - update to Ubuntu Pro
python3.9-minimal (Ubuntu package) - update to Ubuntu Pro
python3.9 (Ubuntu package) - update to Ubuntu Pro
python3.8-minimal (Ubuntu package) - addressed in versions Ubuntu Pro, 3.8.10-0ubuntu1~20.04.10
python3.11-minimal (Ubuntu package) - addressed in versions Ubuntu Pro, 3.11.6-3ubuntu0.1
python3.11 (Ubuntu package) - addressed in versions Ubuntu Pro, 3.11.6-3ubuntu0.1
python3.10-minimal (Ubuntu package) - update to 3.10.12-1~22.04.4
python3.10 (Ubuntu package) - update to 3.10.12-1~22.04.4
python3.12-minimal (Ubuntu package) - update to 3.12.0-1ubuntu0.1
python3.12 (Ubuntu package) - update to 3.12.0-1ubuntu0.1
dev-lang/python - update to 7.3.16
dev-python/pypy3 - update to 7.3.16

• https://www.oracle.com/security-alerts/cpuapr2024.html

• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Data Analytics Function
• Gentoo update for Python, PyPy3
• Ubuntu update for python3.10