{"id":8491,"date":"2021-11-11T17:48:25","date_gmt":"2021-11-12T00:48:25","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?post_type=patch_watch&#038;p=8491"},"modified":"2023-03-03T14:20:28","modified_gmt":"2023-03-03T21:20:28","slug":"october-oracle-patches-419-security-vulnerabilities","status":"publish","type":"patch_watch","link":"https:\/\/webdev.securin.xyz\/patch_watch\/october-oracle-patches-419-security-vulnerabilities\/","title":{"rendered":"October 2021: Oracle Patches 419 Security Vulnerabilities"},"content":{"rendered":"<p dir=\"ltr\">Oracle released security patches for 231 CVEs that fixed 419 vulnerabilities in October 2021. We have analyzed these weaknesses, which include 36 critical vulnerabilities and have highlighted the most important vulnerabilities that ought to be fixed on priority.<\/p>\n<h2 dir=\"ltr\"><img decoding=\"async\" style=\"width: 800px; height: 379px;\" src=\"\/wp-content\/uploads\/2021\/06\/patch-watch-mailchimp-1.png\" alt=\"\" \/><br \/>\n<strong>Weaponized Vulnerabilities<\/strong><\/h2>\n<p dir=\"ltr\">We have 74 vulnerabilities that have known exploits. Here is what we found &#8211;<\/p>\n<ul>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">3 CVEs are associated with the Maze ransomware and APT1 group.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">CVE-2019-11358, CVE-2020-11022 and CVE-2020-11023 are linked to nine malware threats such as OceanSalt, Auriga, Bangat, BISCUIT, MAPIGET, TARSIP, SEASALT,\u00a0 KURTON, and\u00a0 HELAUTO.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">1 CVE has an alert issued by CISA.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">10 CVEs are classified as Remote Code Execution bugs.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">2 CVEs have Privilege Escalation capabilities.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">7 CVEs are rated critical and 44 are of high severity.<\/p>\n<\/li>\n<\/ul>\n<p><img decoding=\"async\" style=\"width: 550px; height: 316px;\" src=\"\/wp-content\/uploads\/2021\/06\/patch-watch-4-12.png\" alt=\"\" \/><\/p>\n<h2 dir=\"ltr\"><strong>Old Vulnerabilities<\/strong><\/h2>\n<p>102 old vulnerabilities, discovered between 2016 and 2020, have been patched this month.<\/p>\n<ul>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">3 CVEs are associated with Maze ransomware and the APT1 group. All three vulnerabilities have a correlation with 9 malware threats (OceanSalt, Auriga, Bangat, BISCUIT, MAPIGET, TARSIP, SEASALT,\u00a0 KURTON, and\u00a0 HELAUTO)<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">1 CVE is associated with Privilege Escalation capabilities.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">2 CVEs are Remote Code Execution bugs.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">4 CVEs have been alerted by CISA.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">17 CVEs are rated critical and 53 are of high severity.<\/p>\n<\/li>\n<\/ul>\n<p dir=\"ltr\"><img decoding=\"async\" style=\"width: 550px; height: 352px;\" src=\"\/wp-content\/uploads\/2021\/06\/patch-watch-2-22.png\" alt=\"\" \/><\/p>\n<h2 dir=\"ltr\"><strong>CISA Alerts<\/strong><\/h2>\n<p>CISA had issued warning alerts for 6 CVEs that received a patch this October.<\/p>\n<ul>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">1 CVE has known exploits.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">CVE-2019-11358 is associated with Maze ransomware, APT1, and 9 malware threats.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">2 CVEs are rated critical and 2 are of high severity.<\/p>\n<\/li>\n<\/ul>\n<p dir=\"ltr\"><img decoding=\"async\" style=\"width: 550px; height: 355px;\" src=\"\/wp-content\/uploads\/2021\/06\/patch-watch-3-15.png\" alt=\"\" \/><\/p>\n<h2 dir=\"ltr\"><strong>Product Analysis<\/strong><\/h2>\n<p dir=\"ltr\">We analyzed the vulnerabilities fixed in 149 products. Here is our analysis:<\/p>\n<p dir=\"ltr\">Oracle Fusion Middleware received the highest number of patches, with a total of 71 vulnerabilities addressed, including 56 that could be exploited by unauthenticated attackers remotely.<\/p>\n<p dir=\"ltr\">MySQL received a huge number of fixes as well, totalling 66. Ten of the flaws can be exploited remotely without authentication.<\/p>\n<p dir=\"ltr\">Financial Services Applications received 44 security fixes (26 remotely exploitable without authentication), while Fusion Middleware received 38 (30 remotely exploitable without authentication).<\/p>\n<p dir=\"ltr\">Some of the other Oracle products have also received more than ten security patches.<\/p>\n<p><img decoding=\"async\" style=\"width: 600px; height: 244px;\" src=\"\/wp-content\/uploads\/2021\/06\/patch-watch-5-3.png\" alt=\"\" \/><\/p>\n<p>&nbsp;<\/p>\n<p><iframe class=\"airtable-embed\" style=\"background: transparent; border: 1px solid #ccc;\" src=\"https:\/\/airtable.com\/embed\/shr5m9R3s3y5392qs?backgroundColor=blue&amp;viewControls=on\" width=\"100%\" height=\"533\" frameborder=\"0\"><\/iframe><\/p>\n<p dir=\"ltr\"><strong>Table: Oracle October Patches 2021<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p dir=\"ltr\">On October 19, 2021, CISA had <a href=\"https:\/\/us-cert.cisa.gov\/ncas\/current-activity\/2021\/10\/19\/oracle-releases-october-2021-critical-patch-update\">issued<\/a> an alert encouraging customers to apply security patches across multiple products. Users are urged to visit Oracle security advisories as soon as possible in order to download the security patches required to fix these vulnerabilities.<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Oracle released security patches for 231 CVEs that fixed 419 vulnerabilities in October 2021. We have analyzed these weaknesses, which include 36 critical vulnerabilities and have highlighted the most important vulnerabilities that ought to be fixed on priority. Weaponized Vulnerabilities We have 74 vulnerabilities that have known exploits. Here is what we found &#8211; 3 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":14441,"parent":0,"menu_order":0,"template":"","meta":{"content-type":""},"patch_category":[292],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/patch_watch\/8491"}],"collection":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/patch_watch"}],"about":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/types\/patch_watch"}],"author":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/users\/1"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/media\/14441"}],"wp:attachment":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/media?parent=8491"}],"wp:term":[{"taxonomy":"patch_category","embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/patch_category?post=8491"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}