{"id":8621,"date":"2021-07-30T05:18:24","date_gmt":"2021-07-30T12:18:24","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?post_type=patch_watch&#038;p=8621"},"modified":"2023-03-03T14:32:25","modified_gmt":"2023-03-03T21:32:25","slug":"july-oracle-patches-342-security-vulnerabilities","status":"publish","type":"patch_watch","link":"https:\/\/webdev.securin.xyz\/patch_watch\/july-oracle-patches-342-security-vulnerabilities\/","title":{"rendered":"July: Oracle Patches 342 Security Vulnerabilities"},"content":{"rendered":"<p dir=\"ltr\">Oracle released patches for 342 security vulnerabilities in July 2021, which include 49 critical vulnerabilities. We have analyzed these weaknesses and have highlighted the most important vulnerabilities that ought to be fixed on priority.<\/p>\n<p><img decoding=\"async\" style=\"width: 800px; height: 424px;\" src=\"\/wp-content\/uploads\/2015\/11\/patch-watch-1-5.png\" alt=\"\" \/><\/p>\n<h2><strong>Weaponized Vulnerabilities<\/strong><\/h2>\n<p dir=\"ltr\">We have 57 vulnerabilities that are known exploits. Here is what we found &#8211;<\/p>\n<ul>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">2 CVEs are associated with the <strong>Maze ransomware<\/strong> and <strong>APT1 group.<\/strong><\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">CVE-2020-11022 and CVE-2020-11023 are linked to nine malware threats such as (<strong>OceanSalt, Auriga, Bangat, BISCUIT, MAPIGET, TARSIP, SEASALT,\u00a0 KURTON, <\/strong>and<strong>\u00a0 HELAUTO<\/strong>).<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">2 CVEs have been alerted by CISA.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">22 CVEs are classified as Remote Code Execution bugs.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">13 CVEs have Privilege Escalation capabilities.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">16 CVEs are rated critical and 28 are of high severity.<\/p>\n<\/li>\n<\/ul>\n<p><img decoding=\"async\" style=\"width: 550px; height: 338px;\" src=\"\/wp-content\/uploads\/2015\/11\/patch-watch-4-2.png\" alt=\"\" \/><\/p>\n<p dir=\"ltr\">As part of the July 2021 CPU, Oracle issued a fix for <strong>CVE-2019-2729<\/strong>, a serious deserialization vulnerability in Oracle WebLogic Server. This vulnerability in Hyperion Infrastructure Technology exists within the Installation and Configuration component and was first addressed as an out-of-band update in June 2019. Classified under the weakness enumeration CWE-284 (Improper Access Control), this critical CVE has a CVSS v3 score of 9.8.<\/p>\n<h2 dir=\"ltr\"><strong>Old Vulnerabilities<\/strong><\/h2>\n<p dir=\"ltr\">165 old vulnerabilities have been patched, ranging from the year 2012 to 2020.<\/p>\n<ul>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">3 CVEs are associated with <strong>Maze ransomware <\/strong>and<strong> the APT1 group<\/strong>. All three vulnerabilities have a correlation with 9 malware threats (<strong>OceanSalt, Auriga, Bangat, BISCUIT, MAPIGET, TARSIP, SEASALT,\u00a0 KURTON, <\/strong>and<strong>\u00a0 HELAUTO<\/strong>)<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">9 CVEs are associated with Privilege Escalation.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">14 CVEs are Remote Code Execution bugs.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">29 CVEs are rated critical and 97 are of high severity.<\/p>\n<\/li>\n<\/ul>\n<p dir=\"ltr\"><img decoding=\"async\" style=\"width: 550px; height: 448px;\" src=\"\/wp-content\/uploads\/2015\/11\/patch-watch-2-7.png\" alt=\"\" \/><\/p>\n<h2 dir=\"ltr\"><strong>CISA Alerts<\/strong><\/h2>\n<p>CISA had issued warning alerts to 16 vulnerabilities.<\/p>\n<ul>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">9 CVEs have known exploits.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">CVE-2019-11358 is associated with<strong> Maze ransomware, APT1, <\/strong>and <strong>9 malware threats.<\/strong><\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">4 CVEs are rated critical and 11 are of high severity.<\/p>\n<\/li>\n<\/ul>\n<p><img decoding=\"async\" style=\"width: 550px; height: 533px;\" src=\"\/wp-content\/uploads\/2015\/11\/patch-watch-3-3.png\" alt=\"\" \/><\/p>\n<h2 dir=\"ltr\"><strong>Product Analysis<\/strong><\/h2>\n<p dir=\"ltr\">We analyzed the vulnerabilities fixed in 18 products &#8211; Oracle Fusion Middleware received the most fixes in this quarterly round of updates, with a total of 48 vulnerabilities addressed, including 35 that could be exploited by unauthenticated attackers from afar. Nine of these are critical-severity defects, with CVSS ratings of 9.8 and 9.9.<\/p>\n<p dir=\"ltr\"><img decoding=\"async\" style=\"width: 800px; height: 453px;\" src=\"\/wp-content\/uploads\/2015\/11\/patch-watch-5.png\" alt=\"\" \/><\/p>\n<p dir=\"ltr\">PeopleSoft, Systems Risk, Commerce, Construction and Engineering, Essbase, JD Edwards, Enterprise Manager, Java SE, Hyperion, and Virtualization are the other product families that received fixes this month.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p><iframe class=\"airtable-embed\" style=\"background: transparent; border: 1px solid #ccc;\" src=\"https:\/\/airtable.com\/embed\/shr5m9R3s3y5392qs?backgroundColor=blue&amp;viewControls=on\" width=\"100%\" height=\"533\" frameborder=\"0\"><\/iframe><\/p>\n<p><strong>Table: Oracle July Critical Patch Update 2021<\/strong><\/p>\n<p>On 20 July 2021, CISA had <a href=\"https:\/\/us-cert.cisa.gov\/ncas\/current-activity\/2021\/07\/20\/oracle-releases-july-2021-critical-patch-update\">issued<\/a> an overall advisory to patch all these Oracle vulnerabilities. Therefore, we recommend Oracle users to update to the latest version as soon as possible.<\/p>\n<p style=\"text-align: center;\">\n<p style=\"text-align: center;\"><span style=\"font-size: 18px;\"><strong>Does your organization have a patch management program? <a href=\"https:\/\/cybersecurityworks.com\/get-quote.php\">Talk to CSW\u2019s Experts to prioritize the threats that need immediate attention!<\/a><\/strong><\/span><\/p>\n<p style=\"text-align: center;\">\n","protected":false},"excerpt":{"rendered":"<p>Oracle released patches for 342 security vulnerabilities in July 2021, which include 49 critical vulnerabilities. We have analyzed these weaknesses and have highlighted the most important vulnerabilities that ought to be fixed on priority. Weaponized Vulnerabilities We have 57 vulnerabilities that are known exploits. Here is what we found &#8211; 2 CVEs are associated with [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":14441,"parent":0,"menu_order":0,"template":"","meta":{"content-type":""},"patch_category":[292],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/patch_watch\/8621"}],"collection":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/patch_watch"}],"about":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/types\/patch_watch"}],"author":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/users\/1"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/media\/14441"}],"wp:attachment":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/media?parent=8621"}],"wp:term":[{"taxonomy":"patch_category","embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/patch_category?post=8621"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}