Oracle全系产品10月重要补丁更新通告
2021-10-21 11:21:54 Author: blog.nsfocus.net(查看原文) 阅读量:42 收藏

2021年10月20日,绿盟科技监测发现Oracle官方发布了10月重要补丁更新公告CPU(Critical Patch Update),此次共修复了419个不同程度的漏洞,此次安全更新涉及Oracle MySQL、Oracle Weblogic Server、Oracle Java SE、Oracle FusionMiddleware、Oracle Retail Applications等多个常用产品。Oracle强烈建议客户尽快应用关键补丁更新修复程序,对漏洞进行修复。

此次安全更新针对Oracle MySQL发布了66个安全补丁, 其中的10个漏洞在未经用户身份验证的情况下即可远程进行利用,即无需用户凭据即可通过网络利用。漏洞编号如下:

此次安全更新针对Oracle Financial Services Applications发布了44个安全补丁。其中的26个漏洞在未经用户身份验证的情况下即可远程进行利用。高危漏洞编号如下:

此次安全更新针对Oracle Insurance Applications发布了16个安全补丁。其中的11个漏洞在未经用户身份验证的情况下即可远程进行利用。攻击者可以通过HTTP访问网络发送恶意请求,从而控制产品中的组件进而对关键数据完全访问。严重漏洞编号如下:

此次安全更新针对Oracle Fusion Middleware发布了38个安全补丁。其中有30个漏洞在未经用户身份验证的情况下即可远程进行利用。高危漏洞编号如下:

此次安全更新针对Oracle Retail Applications发布了26个安全补丁。其中有9个漏洞在未经用户身份验证的情况下即可远程进行利用。高危漏洞编号如下:

受影响产品及版本号可用补丁
Enterprise Manager Base Platform, versions 13.4.0.0, 13.5.0.0https://support.oracle.com/rs?type=doc&id=2796575.1
Enterprise Manager for Oracle Database, version 13.4.0.0https://support.oracle.com/rs?type=doc&id=2796575.1
Enterprise Manager Ops Center, version 12.4.0.0https://support.oracle.com/rs?type=doc&id=2796575.1
Essbase Administration Services, versions prior to 11.1.2.4.46https://support.oracle.com/rs?type=doc&id=2796575.1
Hyperion Financial Management, versions 11.1.2.4, 11.2.6.0https://support.oracle.com/rs?type=doc&id=2796575.1
Hyperion Financial Reporting, versions 11.1.2.4, 11.2.6.0https://support.oracle.com/rs?type=doc&id=2796575.1
Hyperion Infrastructure Technology, version 11.2.6.0https://support.oracle.com/rs?type=doc&id=2796575.1
Hyperion Planning, versions 11.1.2.4, 11.2.6.0https://support.oracle.com/rs?type=doc&id=2796575.1
Instantis EnterpriseTrack, versions 17.1, 17.2, 17.3https://support.oracle.com/rs?type=doc&id=2809438.1
JD Edwards EnterpriseOne Orchestrator, versions prior to 9.2.6.0https://support.oracle.com/rs?type=doc&id=2810363.1
JD Edwards EnterpriseOne Tools, versions prior to 9.2.6.0https://support.oracle.com/rs?type=doc&id=2810363.1
JD Edwards World Security, version A9.4https://support.oracle.com/rs?type=doc&id=2810363.1
MySQL Client, versions 8.0.26 and priorhttps://support.oracle.com/rs?type=doc&id=2809354.1
MySQL Cluster, versions 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior, 8.0.26 and priorhttps://support.oracle.com/rs?type=doc&id=2809354.1
MySQL Connectors, versions 8.0.26 and priorhttps://support.oracle.com/rs?type=doc&id=2809354.1
MySQL Enterprise Monitor, versions 8.0.25 and priorhttps://support.oracle.com/rs?type=doc&id=2809354.1
MySQL Server, versions 5.7.35 and prior, 8.0.26 and priorhttps://support.oracle.com/rs?type=doc&id=2809354.1
MySQL Workbench, versions 8.0.26 and priorhttps://support.oracle.com/rs?type=doc&id=2809354.1
Oracle Agile PLM, versions 9.3.3, 9.3.6https://support.oracle.com/rs?type=doc&id=2810378.1
Oracle Application Express, versions prior to 21.1.0https://support.oracle.com/rs?type=doc&id=2796575.1
Oracle Application Testing Suite, version 13.3.0.1https://support.oracle.com/rs?type=doc&id=2796575.1
Oracle Autovue for Agile Product Lifecycle Management, version 21.0.2https://support.oracle.com/rs?type=doc&id=2810378.1
Oracle Banking Cash Management, versions 14.2, 14.3, 14.5https://support.oracle.com/
Oracle Banking Corporate Lending Process Management, versions 14.2, 14.3, 14.5https://support.oracle.com/
Oracle Banking Credit Facilities Process Management, versions 14.2, 14.3, 14.5https://support.oracle.com/
Oracle Banking Enterprise Default Management, versions 2.10.0, 2.12.0https://support.oracle.com/rs?type=doc&id=2808888.1
Oracle Banking Extensibility Workbench, versions 14.2, 14.3, 14.5https://support.oracle.com/
Oracle Banking Platform, versions 2.6.2, 2.7.1, 2.9.0, 2.12.0https://support.oracle.com/rs?type=doc&id=2808888.1
Oracle Banking Supply Chain Finance, versions 14.2, 14.3, 14.5https://support.oracle.com/
Oracle Banking Trade Finance Process Management, versions 14.2, 14.3, 14.5https://support.oracle.com/
Oracle Banking Virtual Account Management, versions 14.2, 14.3, 14.5https://support.oracle.com/
Oracle Business Activity Monitoring, versions 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0https://support.oracle.com/rs?type=doc&id=2796575.1
Oracle Business Intelligence Enterprise Edition, versions 5.5.0.0.0, 12.2.1.3.0, 12.2.1.4.0https://support.oracle.com/rs?type=doc&id=2796575.1
Oracle Commerce Guided Search, version 11.3.2https://support.oracle.com/rs?type=doc&id=2811064.1
Oracle Commerce Merchandising, version 11.3.2https://support.oracle.com/rs?type=doc&id=2811064.1
Oracle Communications Application Session Controller, version 3.9https://support.oracle.com/rs?type=doc&id=2815518.1
Oracle Communications Billing and Revenue Management, versions 7.5.0.0.0, 12.0.0.3.0https://support.oracle.com/rs?type=doc&id=2808815.1
Oracle Communications BRM – Elastic Charging Engine, version 12.0.0.3https://support.oracle.com/rs?type=doc&id=2808815.1
Oracle Communications Calendar Server, version 8.0.0.6.0https://support.oracle.com/rs?type=doc&id=2808816.1
Oracle Communications Cloud Native Core Network Repository Function, version 1.14.0https://support.oracle.com/rs?type=doc&id=2809116.1
Oracle Communications Cloud Native Core Policy, version 1.11.0https://support.oracle.com/rs?type=doc&id=2809114.1
Oracle Communications Control Plane Monitor, versions 3.4, 4.2, 4.3, 4.4https://support.oracle.com/rs?type=doc&id=2809423.1
Oracle Communications Converged Application Server – Service Controller, version 6.2https://support.oracle.com/rs?type=doc&id=2809113.1
Oracle Communications Design Studio, version 7.4.2https://support.oracle.com/rs?type=doc&id=2808817.1
Oracle Communications Diameter Signaling Router, versions 8.0.0.0-8.5.0.0https://support.oracle.com/rs?type=doc&id=2809085.1
Oracle Communications EAGLEhttps://support.oracle.com/rs?type=doc&id=2809087.1
Oracle Communications EAGLE FTP Table Base Retrieval, version 4.5https://support.oracle.com/rs?type=doc&id=2809115.1
Oracle Communications EAGLE LNP Application Processor, versions 46.7, 46.8, 46.9https://support.oracle.com/rs?type=doc&id=2809093.1
Oracle Communications Element Manager, versions 8.2.0.0-8.2.4.0https://support.oracle.com/rs?type=doc&id=2809094.1
Oracle Communications Fraud Monitor, versions 3.4-4.4https://support.oracle.com/rs?type=doc&id=2809422.1
Oracle Communications Interactive Session Recorder, version 6.4https://support.oracle.com/rs?type=doc&id=2809118.1
Oracle Communications LSMS, versions 13.1-13.4https://support.oracle.com/rs?type=doc&id=2809119.1
Oracle Communications Messaging Server, version 8.1https://support.oracle.com/rs?type=doc&id=2808816.1
Oracle Communications MetaSolv Solution, version 6.3.1https://support.oracle.com/rs?type=doc&id=2808878.1
Oracle Communications Offline Mediation Controller, version 12.0.0.3.0https://support.oracle.com/rs?type=doc&id=2808879.1
Oracle Communications Operations Monitor, versions 3.4, 4.2, 4.3, 4.4https://support.oracle.com/rs?type=doc&id=2809120.1
Oracle Communications Policy Management, version 12.5.0https://support.oracle.com/rs?type=doc&id=2809110.1
Oracle Communications Pricing Design Center, version 12.0.0.3.0https://support.oracle.com/rs?type=doc&id=2808815.1
Oracle Communications Services Gatekeeper, version 7.0https://support.oracle.com/rs?type=doc&id=2809111.1
Oracle Communications Session Border Controller, versions 8.4, 9.0https://support.oracle.com/rs?type=doc&id=2809267.1
Oracle Communications Session Report Manager, versions 8.0.0.0-8.2.5.0https://support.oracle.com/rs?type=doc&id=2811990.1
Oracle Communications Session Route Manager, versions 8.0.0.0-8.2.5.0https://support.oracle.com/rs?type=doc&id=2812072.1
Oracle Data Integrator, version 12.2.1.4.0https://support.oracle.com/rs?type=doc&id=2796575.1
Oracle Database Server, versions 12.1.0.2, 12.2.0.1, 19c, 21chttps://support.oracle.com/rs?type=doc&id=2796575.1
Oracle Documaker, versions 12.6.0-12.6.4https://support.oracle.com/rs?type=doc&id=2809145.1
Oracle E-Business Suite, versions 12.1.1-12.1.3, 12.2.3-12.2.10https://support.oracle.com/rs?type=doc&id=2484000.1
Oracle Enterprise Communications Broker, versions 3.2, 3.3https://support.oracle.com/rs?type=doc&id=2809298.1
Oracle Enterprise Repository, version 11.1.1.7.0https://support.oracle.com/rs?type=doc&id=2796575.1
Oracle Enterprise Telephony Fraud Monitor, versions 3.4, 4.2, 4.3, 4.4https://support.oracle.com/rs?type=doc&id=2810340.1
Oracle Ethernet Switch ES2-64, Oracle Ethernet Switch ES2-72, version 2.0.0.14https://support.oracle.com/rs?type=doc&id=2809232.1
Oracle Financial Services Analytical Applications Infrastructure, versions 8.0.6-8.1.1https://support.oracle.com/rs?type=doc&id=2809214.1
Oracle Financial Services Enterprise Case Management, versions 8.0.7.2.0, 8.0.8.1.0https://support.oracle.com/
Oracle Financial Services Model Management and Governance, versions 8.0.8.0.0-8.1.0.0.0https://support.oracle.com/rs?type=doc&id=2814201.1
Oracle FLEXCUBE Core Banking, versions 11.7, 11.8, 11.9, 11.10https://support.oracle.com/
Oracle Global Lifecycle Management OPatchhttps://support.oracle.com/rs?type=doc&id=2796575.1
Oracle GoldenGate, versions prior to 19.1.0.0.0.210420https://support.oracle.com/rs?type=doc&id=2796575.1
Oracle GoldenGate Application Adapters, version 19.1.0.0.0https://support.oracle.com/rs?type=doc&id=2796575.1
Oracle GraalVM Enterprise Edition, versions 20.3.3, 21.2.0https://support.oracle.com/rs?type=doc&id=2810386.1
Oracle Graph Server and Client, versions prior to 21.3.0https://support.oracle.com/rs?type=doc&id=2796575.1
Oracle Health Sciences Central Coding, versions 6.2.0, 6.3.0https://support.oracle.com/rs?type=doc&id=2806298.1
Oracle Health Sciences InForm, version 6.3.0https://support.oracle.com/rs?type=doc&id=2806298.1
Oracle Healthcare Data Repository, versions 7.0.2, 8.1.0https://support.oracle.com/rs?type=doc&id=2806298.1
Oracle Healthcare Foundation, versions 7.3, 8.0, 8.1https://support.oracle.com/rs?type=doc&id=2806298.1
Oracle Hospitality Cruise Shipboard Property Management System, version 20.1.0https://support.oracle.com/rs?type=doc&id=2806436.1
Oracle HTTP Server, versions 11.1.1.9.0, 12.2.1.4.0https://support.oracle.com/rs?type=doc&id=2796575.1
Oracle Insurance Calculation Engine, versions 11.0.0-11.3.1https://support.oracle.com/rs?type=doc&id=2809145.1
Oracle Insurance Policy Administration, versions 11.0.0-11.3.1https://support.oracle.com/rs?type=doc&id=2809145.1
Oracle Java SE, versions 7u311, 8u301, 11.0.12, 17https://support.oracle.com/rs?type=doc&id=2810386.1
Oracle NoSQL Databasehttps://support.oracle.com/rs?type=doc&id=2796575.1
Oracle Outside In Technology, version 8.5.5https://support.oracle.com/rs?type=doc&id=2796575.1
Oracle Real User Experience Insight, versions 13.4.1.0, 13.5.1.0https://support.oracle.com/rs?type=doc&id=2796575.1
Oracle Real-Time Decision Server, versions 3.2.0.0, 11.1.1.9.0https://support.oracle.com/rs?type=doc&id=2796575.1
Oracle REST Data Services, versions prior to 21.3https://support.oracle.com/rs?type=doc&id=2796575.1
Oracle Retail Advanced Inventory Planning, versions 14.1, 15.0, 16.0https://support.oracle.com/rs?type=doc&id=2801874.1
Oracle Retail Assortment Planning, version 16.0https://support.oracle.com/rs?type=doc&id=2801874.1
Oracle Retail Back Office, versions 14.0, 14.1https://support.oracle.com/rs?type=doc&id=2801874.1
Oracle Retail Bulk Data Integration, versions 16.0.3, 19.0.1https://support.oracle.com/rs?type=doc&id=2801874.1
Oracle Retail Central Office, versions 14.0, 14.1https://support.oracle.com/rs?type=doc&id=2801874.1
Oracle Retail Customer Management and Segmentation Foundation, versions 16.0-19.0https://support.oracle.com/rs?type=doc&id=2801874.1
Oracle Retail Extract Transform and Load, version 13.2.8https://support.oracle.com/rs?type=doc&id=2801874.1
Oracle Retail Financial Integration, versions 14.1.3.2, 15.0.4.0, 16.0.3.0https://support.oracle.com/rs?type=doc&id=2801874.1
Oracle Retail Integration Bus, versions 14.1.3.2, 15.0.4.0, 16.0.3.0, 19.0.1.0https://support.oracle.com/rs?type=doc&id=2801874.1
Oracle Retail Merchandising System, versions 15.0.3, 19.0.1https://support.oracle.com/rs?type=doc&id=2801874.1
Oracle Retail Point-of-Service, versions 14.0, 14.1https://support.oracle.com/rs?type=doc&id=2801874.1
Oracle Retail Predictive Application Server, versions 14.1.3, 15.0.3, 16.0.3https://support.oracle.com/rs?type=doc&id=2801874.1
Oracle Retail Returns Management, versions 14.0, 14.1https://support.oracle.com/rs?type=doc&id=2801874.1
Oracle Retail Service Backbone, versions 14.1.3.2, 15.0.4.0, 16.0.3.0, 19.0.1.0https://support.oracle.com/rs?type=doc&id=2801874.1
Oracle Retail Store Inventory Management, versions 14.1, 15.0, 16.0https://support.oracle.com/rs?type=doc&id=2801874.1
Oracle Secure Backup, versions prior to 18.1.0.1.0https://support.oracle.com/rs?type=doc&id=2796575.1
Oracle Secure Global Desktop, version 5.6https://support.oracle.com/rs?type=doc&id=2810981.1
Oracle Solaris, version 11https://support.oracle.com/rs?type=doc&id=2809232.1
Oracle Spatial Studiohttps://support.oracle.com/rs?type=doc&id=2796575.1
Oracle SQL Developerhttps://support.oracle.com/rs?type=doc&id=2796575.1
Oracle Transportation Management, version 6.4.3https://support.oracle.com/rs?type=doc&id=2810378.1
Oracle Utilities Framework, versions 4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0-4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0https://support.oracle.com/rs?type=doc&id=2809748.1
Oracle VM VirtualBox, versions prior to 6.1.28https://support.oracle.com/rs?type=doc&id=2810981.1
Oracle WebCenter Portal, versions 12.2.1.3.0, 12.2.1.4.0https://support.oracle.com/rs?type=doc&id=2796575.1
Oracle WebCenter Sites, versions 12.2.1.3.0, 12.2.1.4.0https://support.oracle.com/rs?type=doc&id=2796575.1
Oracle WebLogic Server, versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0https://support.oracle.com/rs?type=doc&id=2796575.1
Oracle WebLogic Server Proxy Plug-In, versions 12.2.1.3.0, 12.2.1.4.0https://support.oracle.com/rs?type=doc&id=2796575.1
Oracle ZFS Storage Appliance Kit, version 8.8https://support.oracle.com/rs?type=doc&id=2809232.1
PeopleSoft Enterprise CC Common Application Objects, version 9.2https://support.oracle.com/rs?type=doc&id=2810361.1
PeopleSoft Enterprise CS Academic Advisement, version 9.2https://support.oracle.com/rs?type=doc&id=2810361.1
PeopleSoft Enterprise CS Campus Community, versions 9.0, 9.2https://support.oracle.com/rs?type=doc&id=2810361.1
PeopleSoft Enterprise CS SA Integration Pack, versions 9.0, 9.2https://support.oracle.com/rs?type=doc&id=2810361.1
PeopleSoft Enterprise CS Student Records, version 9.2https://support.oracle.com/rs?type=doc&id=2810361.1
PeopleSoft Enterprise PeopleTools, versions 8.57, 8.58, 8.59https://support.oracle.com/rs?type=doc&id=2810361.1
PeopleSoft Enterprise SCM, version 9.2https://support.oracle.com/rs?type=doc&id=2810361.1
Primavera Gateway, versions 17.12.0-17.12.11, 18.8.0-18.8.12, 19.12.0-19.12.11, 20.12.0-20.12.7https://support.oracle.com/rs?type=doc&id=2809438.1
Primavera Unifier, versions 17.7-17.12, 18.8, 19.12, 20.12https://support.oracle.com/rs?type=doc&id=2809438.1
Siebel Applications, versions 21.9 and priorhttps://support.oracle.com/rs?type=doc&id=2810362.1
Tekelec Platform Distribution, versions 7.4.0-7.7.1https://support.oracle.com/rs?type=doc&id=2809117.1
Tekelec Virtual Operating Environment, versions 3.4.0-3.7.1https://support.oracle.com/rs?type=doc&id=2809138.1

本安全公告仅用来描述可能存在的安全问题,绿盟科技不为此安全公告提供任何保证或承诺。由于传播、利用此安全公告所提供的信息而造成的任何直接或者间接的后果及损失,均由使用者本人负责,绿盟科技以及安全公告作者不为此承担任何责任。

绿盟科技拥有对此安全公告的修改和解释权。如欲转载或传播此安全公告,必须保证此安全公告的完整性,包括版权声明等全部内容。未经绿盟科技允许,不得任意修改或者增减此安全公告内容,不得以任何方式将其用于商业目的。


文章来源: http://blog.nsfocus.net/oracle202110/
如有侵权请联系:admin#unsafe.sh