{"id":8677,"date":"2021-05-04T06:30:11","date_gmt":"2021-05-04T13:30:11","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?post_type=patch_watch&#038;p=8677"},"modified":"2023-03-07T15:21:44","modified_gmt":"2023-03-07T22:21:44","slug":"april-oracle-patches-390-security-vulnerabilities","status":"publish","type":"patch_watch","link":"https:\/\/webdev.securin.xyz\/patch_watch\/april-oracle-patches-390-security-vulnerabilities\/","title":{"rendered":"April: Oracle Patches 390 Security Vulnerabilities"},"content":{"rendered":"<p dir=\"ltr\">Oracle released patches for 390 security vulnerabilities in April 2021. We analyzed these weaknesses and spotlighted important vulnerabilities that ought to be patched on priority.<\/p>\n<p dir=\"ltr\"><img decoding=\"async\" class=\"aligncenter\" style=\"width: 800px; height: 499px;\" src=\"\/wp-content\/uploads\/2015\/11\/highlights_new.jpg\" alt=\"\" \/><\/p>\n<h2 dir=\"ltr\">Oracle\u2019s April Patches Overview<\/h2>\n<p dir=\"ltr\">In April, Oracle patched 390 vulnerabilities including 29 known exploits \u2013<\/p>\n<p dir=\"ltr\"><strong>RCE\/PE:<\/strong>\u00a0 Oracle has fixed \u2013<\/p>\n<ul>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">1 CVE that has RCE capabilities<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">1 CVE with Privilege Escalation capabilities<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">12 CVEs with Cross Site Scripting vulnerabilities<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">4 CVEs with Prototype pollution.<\/p>\n<\/li>\n<\/ul>\n<p dir=\"ltr\"><strong>Old Vulnerabilities:\u00a0<\/strong>Oracle issued patches for 201 old vulnerabilities ranging from the year 2016 \u2013 2020. These security updates include zerologon vulnerability (CVE-2020-1472) which was one of the actively exploited Privilege Escalation vulnerabilities associated with Cryptomix ransomware strain.<\/p>\n<p dir=\"ltr\">Four old vulnerabilities have been red flagged by CISA (CVE-2019-0228, CVE-2020-5421, CVE-2020-8203, CVE-2020-5421), therefore patching them would be essential. Among the 201 CVEs, 19 have rated critical and 108 are of high severity.<\/p>\n<p><strong>CISA Alerts:\u00a0<\/strong>Eight CVEs have featured in CISA Alerts (CVE-2021-2207, CVE-2019-0228, CVE-2020-5421, CVE-2020-8203, CVE-2021-2200, CVE-2021-2183, CVE-2021-2206, CVE-2021-2259).<\/p>\n<p dir=\"ltr\">Two CVEs are rated critical, and two CVEs are of high severity with one weaponized vulnerability (CVE-2020-8203) among them.<\/p>\n<p dir=\"ltr\">CISA has <a href=\"https:\/\/us-cert.cisa.gov\/ncas\/current-activity\/2021\/04\/20\/oracle-releases-april-2021-critical-patch-update\">issued<\/a> a special alert for Oracle April 2021 Critical Patch Update to urge users and administrators to apply necessary patches.<\/p>\n<h2 dir=\"ltr\">Severity Scores<\/h2>\n<p dir=\"ltr\"><img decoding=\"async\" class=\"aligncenter\" style=\"width: 550px; height: 384px;\" src=\"\/wp-content\/uploads\/2015\/11\/old-vulnerabilities-1.jpg\" alt=\"\" \/><\/p>\n<h2 dir=\"ltr\">Product Analysis<\/h2>\n<p dir=\"ltr\">The quarterly set of security patches addressed vulnerabilities in 32 Oracle products and Oracle E-Business Suite Risk Matrix accounted for 70 vulnerabilities in which 22 CVEs could be exploited remotely by unauthenticated attackers.<\/p>\n<p>\u00a0 \u00a0<img decoding=\"async\" class=\"aligncenter\" style=\"width: 800px; height: 369px;\" src=\"\/wp-content\/uploads\/2015\/11\/product-analysis-01.png\" alt=\"\" \/><\/p>\n<p><iframe class=\"airtable-embed\" style=\"background: transparent; border: 1px solid #ccc;\" src=\"https:\/\/airtable.com\/embed\/shrBYIWWMQuJuxBzG?backgroundColor=purple&amp;viewControls=on\" width=\"100%\" height=\"533\" frameborder=\"0\"><\/iframe><\/p>\n<p dir=\"ltr\"><span style=\"font-size: 12px;\"><strong>Table: Oracle Critical Patches April 2021<\/strong><\/span><\/p>\n<p>Interestingly, 99% of the weaponized vulnerabilities are older weaknesses and failure to patch them creates a path to malicious hackers. Therefore, it is crucial to apply critical patches and reduce the risk of an attack.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Oracle released patches for 390 security vulnerabilities in April 2021. We analyzed these weaknesses and spotlighted important vulnerabilities that ought to be patched on priority. Oracle\u2019s April Patches Overview In April, Oracle patched 390 vulnerabilities including 29 known exploits \u2013 RCE\/PE:\u00a0 Oracle has fixed \u2013 1 CVE that has RCE capabilities 1 CVE with Privilege [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":14441,"parent":0,"menu_order":0,"template":"","meta":{"content-type":""},"patch_category":[292],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/patch_watch\/8677"}],"collection":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/patch_watch"}],"about":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/types\/patch_watch"}],"author":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/users\/1"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/media\/14441"}],"wp:attachment":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/media?parent=8677"}],"wp:term":[{"taxonomy":"patch_category","embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/patch_category?post=8677"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}