Oracle全系产品1月关键补丁更新通告

阅读： 891

一、概述

近日，绿盟科技CERT监测发现Oracle官方发布了1月关键补丁更新公告CPU（Critical Patch Update），此次共修复了413个不同程度的漏洞，此次安全更新涉及Oracle WebLogic Server、Oracle MySQL、Oracle Java SE、Oracle Fusion Middleware、Oracle HTTP Server等多个常用产品。Oracle强烈建议客户尽快应用关键补丁更新修复程序，对漏洞进行修复。

参考链接：

https://www.oracle.com/security-alerts/cpujan2024.html

二、重点漏洞概述

根据产品流行度和漏洞重要性筛选出此次更新中包含影响较大的漏洞，请相关用户重点进行关注：

Oracle WebLogic Server安全特性绕过漏洞（CVE-2024-20927）：

Oracle WebLogic Server中存在安全特性绕过漏洞。未经身份验证的远程攻击者可通过该漏洞破坏系统完整性。。

Oracle WebLogic Server信息泄漏漏洞（CVE-2024-20931）:

Oracle WebLogic Server存在信息泄露漏洞，未经身份验证的攻击者通过T3/IIOP协议向受影响的服务器发送特制的请求，可能实现对关键数据的非法访问或对所有Oracle WebLogic Server所有数据的完全访问，造成敏感信息泄露。

Oracle WebLogic Server安全特性绕过漏洞（CVE-2024-20986）:

Oracle WebLogic Server 中存在安全特性绕过漏洞，未经身份验证的远程攻击者在诱导受害者交互后，可通过该漏洞破坏系统完整性或泄露敏感信息。

Oracle MySQL多个漏洞：

此次安全更新针对Oracle MySQL修复了40个漏洞, 其中有12个漏洞在未经用户身份验证的情况下即可远程进行利用，即无需用户凭据即可通过网络利用。高危漏洞编号如下：

CVE-2023-38545

CVE-2023-50164

CVE-2023-5363

CVE-2023-46589

CVE-2023-5363

CVE-2023-41105

Oracle Financial Services Applications多个漏洞：

此次安全更新针对Oracle Financial Services Applications修复了71个漏洞。其中的54个漏洞在未经用户身份验证的情况下即可远程进行利用。高危漏洞编号如下：

CVE-2023-46604

CVE-2022-42920

CVE-2023-24998

CVE-2022-34169

CVE-2023-24998

Oracle官方1月关键补丁更新漏洞总结如下：

产品	漏洞个数	未授权远程利用个数	最高CVSS评分
Oracle Database Products Risk Matrices	3	0	6.5
Oracle Database Server	3	0	6.5
Oracle Audit Vault and Database Firewall	5	1	7.6
Oracle Big Data Spatial and Graph	1	1	7.5
Oracle Essbase	3	2	9.8
Oracle Global Lifecycle Management	1	1	3.7
Oracle GoldenGate	1	1	3.7
Oracle Graph Server and Client	1	1	7.5
Oracle NoSQL Database	1	0	6.5
Oracle REST Data Services	5	4	7.5
Oracle Secure Backup	5	4	7.5
Oracle SQL Developer	5	4	7.5
Oracle TimesTen In-Memory Database	5	4	7.5
Oracle Commerce	5	4	7.5
Oracle Communications Applications	43	25	9.8
Oracle Communications	55	43	9.8
Oracle Construction and Engineering	6	2	7.5
Oracle E-Business Suite	19	14	6.5
Oracle Enterprise Manager	12	11	8.3
Oracle Financial Services Applications	71	54	9.8
Oracle Fusion Middleware	39	29	9.8
Oracle Analytics	17	11	8.2
Oracle Hyperion	11	10	9.8
Oracle Java SE	13	11	7.5
Oracle JD Edwards	9	6	9.8
Oracle MySQL	40	12	9.8
Oracle PeopleSoft	4	2	7.5
Oracle Retail Applications	6	5	9.8
Oracle Siebel CRM	2	2	7.5
Oracle Supply Chain	6	4	8.8
Oracle Systems	9	3	9.8
Oracle Utilities Applications	7	3	7.5

三、漏洞防护

补丁更新

请用户参考本文附录“受影响产品及补丁信息”及时下载受影响产品更新补丁，并参照补丁安装包中的readme文件进行安装更新，以保证长期有效的防护。

注：Oracle官方补丁需要用户持有正版软件的许可账号，使用该账号登陆https://support.oracle.com后，可以下载最新补丁。

Weblogic临时防护措施

3.2.1 限制T3协议访问

若相关用户暂时无法安装补丁或不通过T3协议进行JVM通信，可使用下列措施阻断针对利用T3协议漏洞的攻击：

WebLogic Server提供了名为 weblogic.security.net.ConnectionFilterImpl 的默认连接筛选器，此连接筛选器接受所有传入连接，可通过此连接筛选器配置规则，对T3及T3s协议进行访问控制，详细操作步骤如下：

进入WebLogic控制台，在base_domain的配置页面中，进入“安全”选项卡页面，点击“筛选器”，进入连接筛选器配置。

在连接筛选器中输入：weblogic.security.net.ConnectionFilterImpl，参考以下写法，在连接筛选器规则中配置符合企业实际情况的规则：

127.0.0.1 * * allow t3 t3s

本机IP ** allow t3 t3s

允许访问的IP * * allow t3 t3s

* * * deny t3 t3s

连接筛选器规则格式如下：target localAddress localPort action protocols，其中：

· target 指定一个或多个要筛选的服务器。

· localAddress 可定义服务器的主机地址。(如果指定为一个星号 (*)，则返回的匹配结果将是所有本地 IP 地址。)

· localPort 定义服务器正在监听的端口。(如果指定了星号，则匹配返回的结果将是服务器上所有可用的端口)。

· action 指定要执行的操作。(值必须为“allow”或“deny”。)

· protocols 是要进行匹配的协议名列表。(必须指定下列其中一个协议：http、https、t3、t3s、giop、giops、dcom 或 ftp。) 如果未定义协议，则所有协议都将与一个规则匹配。

保存后若规则未生效，建议重新启动WebLogic服务（重启WebLogic服务会导致业务中断，建议相关人员评估风险后，再进行操作）。以Windows环境为例，重启服务的步骤如下：

进入域所在目录下的bin目录，在Windows系统中运行stopWebLogic.cmd文件终止WebLogic服务，Linux系统中则运行stopWebLogic.sh文件。

待终止脚本执行完成后，再运行startWebLogic.cmd或startWebLogic.sh文件启动WebLogic，即可完成WebLogic服务重启。

参考链接：https://docs.oracle.com/cd/E24329_01/web.1211/e24485/con_filtr.htm#SCPRG377

3.2.2禁用IIOP协议

用户可通过关闭IIOP协议阻断针对利用IIOP协议漏洞的攻击，操作如下：

在WebLogic控制台中，选择“服务”->“AdminServer”->“协议”，取消“启用IIOP”的勾选。并重启WebLogic项目，使配置生效。

附录受影响产品及补丁信息

受影响产品及版本号	可用补丁
Fujitsu M10-1, M10-4, M10-4S, M12-1, M12-2, M12-2S Servers, versions prior to XCP2430, prior to XCP3130, prior to XCP4040	https://support.oracle.com/rs?type=doc&id=2992074.1
GoldenGate Big Data and Application Adapters, versions 19.1.0.0.0-19.1.0.0.16, 21.3-21.12	https://support.oracle.com/rs?type=doc&id=2986269.1
Integrated Lights Out Manager (ILOM), versions 3, 4, 5	https://support.oracle.com/rs?type=doc&id=2992074.1
JD Edwards EnterpriseOne Orchestrator, versions prior to 9.2.8.0	https://support.oracle.com/rs?type=doc&id=2993346.1
JD Edwards EnterpriseOne Tools, versions prior to 9.2.8.1	https://support.oracle.com/rs?type=doc&id=2993346.1
MySQL Cluster, versions 7.5.32 and prior, 7.6.28 and prior, 8.0.35 and prior, 8.1.0, 8.2.0 and prior	https://support.oracle.com/rs?type=doc&id=2992139.1
MySQL Connectors, versions 8.0.35 and prior, 8.2.0 and prior	https://support.oracle.com/rs?type=doc&id=2992139.1
MySQL Enterprise Monitor, versions 8.0.36 and prior	https://support.oracle.com/rs?type=doc&id=2992139.1
MySQL Server, versions 8.0.35 and prior, 8.1.0, 8.2.0 and prior	https://support.oracle.com/rs?type=doc&id=2992139.1
MySQL Workbench, versions 8.0.34 and prior	https://support.oracle.com/rs?type=doc&id=2992139.1
Oracle Access Manager, version 12.2.1.4.0	https://support.oracle.com/rs?type=doc&id=2991923.2
Oracle Agile PLM, version 9.3.6	https://support.oracle.com/rs?type=doc&id=2993347.1
Oracle Agile Product Lifecycle Management for Process, versions prior to 6.2.4.2	https://support.oracle.com/rs?type=doc&id=2993347.1
Oracle Analytics Desktop, versions 6.4.0.0.0, prior to 7.2	https://support.oracle.com/rs?type=doc&id=2991925.2
Oracle Application Testing Suite, version 13.3.0.1	https://support.oracle.com/rs?type=doc&id=2986271.1
Oracle Audit Vault and Database Firewall, versions 20.1-20.9	https://support.oracle.com/rs?type=doc&id=2986269.1
Oracle Banking APIs, versions 19.1.0, 21.1.0, 22.1.0, 22.2.0	https://support.oracle.com
Oracle Banking Branch, versions 14.5.0-14.7.0	https://support.oracle.com
Oracle Banking Cash Management, versions 14.5.0-14.7.0	https://support.oracle.com
Oracle Banking Collections and Recovery, versions 14.5.0-14.7.0	https://support.oracle.com
Oracle Banking Corporate Lending Process Management, versions 14.5.0-14.7.0	https://support.oracle.com
Oracle Banking Credit Facilities Process Management, versions 14.5.0-14.7.0	https://support.oracle.com
Oracle Banking Digital Experience, versions 19.1.0, 21.1.0, 22.1.0, 22.2.0	https://support.oracle.com
Oracle Banking Electronic Data Exchange for Corporates, versions 14.5.0-14.7.0	https://support.oracle.com
Oracle Banking Enterprise Default Management, versions 14.5.0-14.7.0	https://support.oracle.com/rs?type=doc&id=2992598.1
Oracle Banking Extensibility Workbench, versions 14.5.0-14.7.0	https://support.oracle.com
Oracle Banking Liquidity Management, versions 14.5.0-14.7.0, 14.7.0.3.0	https://support.oracle.com
Oracle Banking Origination, versions 14.5.0-14.7.0	https://support.oracle.com
Oracle Banking Party Management, versions 14.5.0-14.7.0	https://support.oracle.com/rs?type=doc&id=2992598.1
Oracle Banking Supply Chain Finance, versions 14.5.0-14.7.0	https://support.oracle.com
Oracle Banking Trade Finance Process Management, versions 14.5.0-14.7.0	https://support.oracle.com
Oracle Banking Virtual Account Management, versions 14.5.0-14.7.0	https://support.oracle.com
Oracle BI Publisher, versions 6.4.0.0.0, 7.0.0.0.0, 12.2.1.4.0	https://support.oracle.com/rs?type=doc&id=2991925.2
Oracle Big Data Spatial and Graph, version 3.0.4	https://support.oracle.com/rs?type=doc&id=2986269.1
Oracle Business Intelligence Enterprise Edition, versions 6.4.0.0.0, 7.0.0.0.0, 12.2.1.4.0	https://support.oracle.com/rs?type=doc&id=2991925.2
Oracle Business Process Management Suite, version 12.2.1.4.0	https://support.oracle.com/rs?type=doc&id=2991923.2
Oracle Coherence, versions 12.2.1.4.0, 14.1.1.0.0	https://support.oracle.com/rs?type=doc&id=2991923.2
Oracle Commerce Guided Search, version 11.3.2	https://support.oracle.com/rs?type=doc&id=2993583.1
Oracle Commerce Platform, version 11.3.2	https://support.oracle.com/rs?type=doc&id=2993583.1
Oracle Communications ASAP, version 7.4	https://support.oracle.com/rs?type=doc&id=2992397.1
Oracle Communications Billing and Revenue Management, versions 12.0.0.4.0-12.0.0.8.0, 15.0.0.0.0	https://support.oracle.com/rs?type=doc&id=2992408.1
Oracle Communications BRM – Elastic Charging Engine, versions 12.0.0.4-12.0.0.8	https://support.oracle.com/rs?type=doc&id=2992676.1
Oracle Communications Cloud Native Core Automated Test Suite, versions 23.1.3, 23.2.1, 23.3.0	https://support.oracle.com/rs?type=doc&id=2994836.1
Oracle Communications Cloud Native Core Console, versions 23.3.0, 23.3.1	https://support.oracle.com/rs?type=doc&id=2996591.1
Oracle Communications Cloud Native Core Network Data Analytics Function, versions 23.3.0, 23.4.0	https://support.oracle.com/rs?type=doc&id=2994863.1
Oracle Communications Cloud Native Core Network Exposure Function, version 23.3.1	https://support.oracle.com/rs?type=doc&id=2996601.1
Oracle Communications Cloud Native Core Network Function Cloud Native Environment, versions 23.1.0, 23.2.0, 23.3.1	https://support.oracle.com/rs?type=doc&id=2994716.1
Oracle Communications Cloud Native Core Network Repository Function, versions 23.1.4, 23.3.1	https://support.oracle.com/rs?type=doc&id=2994837.1
Oracle Communications Cloud Native Core Network Slice Selection Function, versions 23.2.0, 23.3.1	https://support.oracle.com/rs?type=doc&id=2994716.1
Oracle Communications Cloud Native Core Security Edge Protection Proxy, versions 23.1.0, 23.2.0, 23.3.0	https://support.oracle.com/rs?type=doc&id=2994878.1
Oracle Communications Cloud Native Core Unified Data Repository, version 23.3.1	https://support.oracle.com/rs?type=doc&id=2996603.1
Oracle Communications Convergence, versions 3.0.3.2, 3.0.3.3	https://support.oracle.com/rs?type=doc&id=2992469.1
Oracle Communications Convergent Charging Controller, versions 6.0.1.0.0, 12.0.1.0.0-12.0.6.0.0, 15.0.0.0.0	https://support.oracle.com/rs?type=doc&id=2992468.1
Oracle Communications Diameter Signaling Router, versions 8.6.0.0, 9.0.0.0	https://support.oracle.com/rs?type=doc&id=2994879.1
Oracle Communications Element Manager, versions 9.0.0.0.0-9.0.2.0.1, 9.4.53	https://support.oracle.com/rs?type=doc&id=2994838.1
Oracle Communications Fraud Monitor, versions 5.0, 5.1	https://support.oracle.com/rs?type=doc&id=2996604.1
Oracle Communications Instant Messaging Server, version 10.0.1.7.0	https://support.oracle.com/rs?type=doc&id=2992469.1
Oracle Communications IP Service Activator, versions 7.4.0, 7.5.0	https://support.oracle.com/rs?type=doc&id=2992410.1
Oracle Communications Messaging Server, version 8.1.0.24.0	https://support.oracle.com/rs?type=doc&id=2992469.1
Oracle Communications MetaSolv Solution, version 6.3.1.0.0	https://support.oracle.com/rs?type=doc&id=2992415.1
Oracle Communications Network Analytics Data Director, versions 23.2.0.0.2, 23.3.0.0.0	https://support.oracle.com/rs?type=doc&id=2994883.1
Oracle Communications Network Charging and Control, versions 6.0.1.0.0, 12.0.1.0.0-12.0.6.0.0, 15.0.0.0.0	https://support.oracle.com/rs?type=doc&id=2992468.1
Oracle Communications Order and Service Management, versions 7.4.0, 7.4.1	https://support.oracle.com/rs?type=doc&id=2992395.1
Oracle Communications Policy Management, versions 12.6.1.0.0, 15.0.0.0.0	https://support.oracle.com/rs?type=doc&id=2994869.1
Oracle Communications Pricing Design Center, versions 12.0.0.4.0-12.0.0.8.0, 15.0.0.0.0	https://support.oracle.com/rs?type=doc&id=2992675.1
Oracle Communications Service Catalog and Design, versions 7.4.0.7.0, 7.4.1.5.0, 7.4.2.8.0	https://support.oracle.com/rs?type=doc&id=2992416.1
Oracle Communications Session Report Manager, versions 9.0.0.0.0-9.0.2.0.1, 9.4.53	https://support.oracle.com/rs?type=doc&id=2994862.1
Oracle Communications Unified Assurance, versions 5.0.0-5.5.19, 6.0.0-6.0.3	https://support.oracle.com/rs?type=doc&id=2997814.1
Oracle Communications Unified Inventory Management, versions 7.4.0, 7.4.1, 7.4.2	https://support.oracle.com/rs?type=doc&id=2992387.1
Oracle Complex Maintenance, Repair, and Overhaul, versions 11.5, 12.1, 12.2	https://support.oracle.com/rs?type=doc&id=2993347.1
Oracle Database Server, versions 19.3-19.21, 21.3-21.12, 22.3-23.8, 23.9.0-23.9.4, 23.10	https://support.oracle.com/rs?type=doc&id=2986269.1
Oracle E-Business Suite, versions 12.2.3-12.2.13	https://support.oracle.com/rs?type=doc&id=2484000.1
Oracle Enterprise Data Quality, version 12.2.1.4.0	https://support.oracle.com/rs?type=doc&id=2991923.2
Oracle Enterprise Manager Base Platform, version 13.5.0.0	https://support.oracle.com/rs?type=doc&id=2986271.1
Oracle Enterprise Manager for Fusion Middleware, version 13.5.0.0	https://support.oracle.com/rs?type=doc&id=2986271.1
Oracle Enterprise Manager for Oracle Database, version 13.5.0.0	https://support.oracle.com/rs?type=doc&id=2986271.1
Oracle Enterprise Manager for Oracle Virtual Infrastructure, version 13.5.0.0	https://support.oracle.com/rs?type=doc&id=2986271.1
Oracle Enterprise Manager for Virtualization, version 13.5.0.0	https://support.oracle.com/rs?type=doc&id=2986271.1
Oracle Enterprise Manager Ops Center, version 12.4.0.0	https://support.oracle.com/rs?type=doc&id=2986271.1
Oracle Essbase, version 21.5.3.0.0	https://support.oracle.com/rs?type=doc&id=2986269.1
Oracle Financial Services Analytical Applications Infrastructure, versions 8.0.7, 8.0.8, 8.0.9, 8.1.0, 8.1.1, 8.1.2	https://support.oracle.com/rs?type=doc&id=2995877.1
Oracle Financial Services Behavior Detection Platform, versions 8.0.8.1, 8.1.1.1, 8.1.2.5, 8.1.2.6	https://support.oracle.com/rs?type=doc&id=2992488.1
Oracle Financial Services Compliance Studio, version 8.1.2.5	https://support.oracle.com/rs?type=doc&id=2992388.1
Oracle Financial Services Enterprise Case Management, versions 8.0.8.2, 8.1.1.1, 8.1.2.5, 8.1.2.6	https://support.oracle.com/rs?type=doc&id=2992664.1
Oracle Financial Services Lending and Leasing, versions 14.5.0-14.7.0	https://support.oracle.com
Oracle Financial Services Revenue Management and Billing, versions 2.7.1, 2.8.0, 2.9.0, 2.9.1, 3.0.0-3.2.0, 4.0.0, 5.0.0, 5.1.0, 6.0.0	https://support.oracle.com/rs?type=doc&id=2996660.1
Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition, version 8.0.8	https://support.oracle.com/rs?type=doc&id=2992489.1
Oracle FLEXCUBE Enterprise Limits and Collateral Management, versions 14.5.0-14.7.0	https://support.oracle.com
Oracle FLEXCUBE Investor Servicing, versions 14.5.0-14.7.0	https://support.oracle.com
Oracle FLEXCUBE Private Banking, versions 14.5.0-14.7.0	https://support.oracle.com
Oracle Fusion Middleware, version 12.2.1.4.0	https://support.oracle.com/rs?type=doc&id=2991923.2
Oracle Global Lifecycle Management OPatch, versions prior to 12.2.0.1.40	https://support.oracle.com/rs?type=doc&id=2986269.1
Oracle GoldenGate, versions 19.1.0.0.0-19.1.0.0.231017, 21.3-21.12	https://support.oracle.com/rs?type=doc&id=2986269.1
Oracle GoldenGate Studio, version 12.2.0.4.0	https://support.oracle.com/rs?type=doc&id=2986269.1
Oracle GraalVM Enterprise Edition, versions 20.3.12, 21.3.8, 22.3.4	https://support.oracle.com/rs?type=doc&id=2992318.1
Oracle GraalVM for JDK, versions 17.0.9, 21.0.1	https://support.oracle.com/rs?type=doc&id=2992318.1
Oracle Graph Server and Client, versions prior to 22.4.6, prior to 23.4.0	https://support.oracle.com/rs?type=doc&id=2986269.1
Oracle HTTP Server, version 12.2.1.4.0	https://support.oracle.com/rs?type=doc&id=2991923.2
Oracle Hyperion Calculation Manager, version 11.2.14.0.0	https://support.oracle.com/rs?type=doc&id=2775466.2
Oracle Hyperion Financial Data Quality Management, Enterprise Edition, version 11.2.14.0.0	https://support.oracle.com/rs?type=doc&id=2775466.2
Oracle Hyperion Financial Management, version 11.2.14.0.0	https://support.oracle.com/rs?type=doc&id=2775466.2
Oracle Hyperion Financial Reporting, version 11.2.14.0.0	https://support.oracle.com/rs?type=doc&id=2775466.2
Oracle Hyperion Infrastructure Technology, version 11.2.14.0.0	https://support.oracle.com/rs?type=doc&id=2775466.2
Oracle Hyperion Planning, version 11.2.14.0.0	https://support.oracle.com/rs?type=doc&id=2775466.2
Oracle Identity Manager, version 12.2.1.4.0	https://support.oracle.com/rs?type=doc&id=2991923.2
Oracle Java SE, versions 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1	https://support.oracle.com/rs?type=doc&id=2992318.1
Oracle JDeveloper, version 12.2.1.4.0	https://support.oracle.com/rs?type=doc&id=2991923.2
Oracle Managed File Transfer, version 12.2.1.4.0	https://support.oracle.com/rs?type=doc&id=2991923.2
Oracle Middleware Common Libraries and Tools, version 12.2.1.4.0	https://support.oracle.com/rs?type=doc&id=2991923.2
Oracle NoSQL Database, versions prior to 1.6, prior to 19.5.40, prior to 20.3.38, prior to 21.2.30, prior to 22.3.94, prior to 23.1.29	https://support.oracle.com/rs?type=doc&id=2986269.1
Oracle Outside In Technology, version 8.5.6	https://support.oracle.com/rs?type=doc&id=2991923.2
Oracle REST Data Services, versions prior to 23.3.0	https://support.oracle.com/rs?type=doc&id=2986269.1
Oracle Retail Advanced Inventory Planning, versions 15.0.3, 16.0.3	https://support.oracle.com/rs?type=doc&id=2992095.1
Oracle Retail Customer Management and Segmentation Foundation, versions 18.0.0.14, 19.0.0.8	https://support.oracle.com/rs?type=doc&id=2992095.1
Oracle Retail EFTLink, versions 20.0.1, 21.0.0-23.0.0	https://support.oracle.com/rs?type=doc&id=2992095.1
Oracle Secure Backup, versions prior to 18.1.0.2.0	https://support.oracle.com/rs?type=doc&id=2986269.1
Oracle Service Bus, version 12.2.1.4.0	https://support.oracle.com/rs?type=doc&id=2991923.2
Oracle SOA Suite, version 12.2.1.4.0	https://support.oracle.com/rs?type=doc&id=2991923.2
Oracle Solaris, version 11	https://support.oracle.com/rs?type=doc&id=2992074.1
Oracle SQL Developer, versions 21.4.2, 22.2.0, 23.1.0	https://support.oracle.com/rs?type=doc&id=2986269.1
Oracle Utilities Network Management System, versions 2.3.0.2, 2.4.0.1, 2.5.0.1, 2.5.0.2, 2.6.0.0, 2.6.0.1	https://support.oracle.com/rs?type=doc&id=2992789.1
Oracle Utilties Application Framework, versions 4.3.0.3.0-4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0, 4.5.0.0.0, 4.5.0.1.1, 4.5.0.1.3	https://support.oracle.com/rs?type=doc&id=2992789.1
Oracle WebCenter Content, version 12.2.1.4.0	https://support.oracle.com/rs?type=doc&id=2991923.2
Oracle WebCenter Portal, version 12.2.1.4.0	https://support.oracle.com/rs?type=doc&id=2991923.2
Oracle WebCenter Sites, version 12.2.1.4.0	https://support.oracle.com/rs?type=doc&id=2991923.2
Oracle WebLogic Server, versions 12.2.1.4.0, 14.1.1.0.0	https://support.oracle.com/rs?type=doc&id=2991923.2
Oracle ZFS Storage Appliance Kit, version 8.8	https://support.oracle.com/rs?type=doc&id=2992074.1
PeopleSoft Enterprise PeopleTools, versions 8.59, 8.60, 8.61	https://support.oracle.com/rs?type=doc&id=2993343.1
Primavera P6 Enterprise Project Portfolio Management, versions 19.12.0-19.12.22, 20.12.0-20.12.20, 21.12.0-21.12.17, 22.12.0-22.12.10	https://support.oracle.com/rs?type=doc&id=2993521.1
Primavera Unifier, versions 19.12.0-19.12.16, 20.12.0-20.12.16, 21.12.0-21.12.17, 22.12.0-22.12.11	https://support.oracle.com/rs?type=doc&id=2993521.1
Siebel Applications, versions prior to 23.12	https://support.oracle.com/rs?type=doc&id=2993345.1
TimesTen In-Memory Database, versions prior to 21.1.1.19.0, prior to 22.1.1.19.0	https://support.oracle.com/rs?type=doc&id=2986269.1

声明

本安全公告仅用来描述可能存在的安全问题，绿盟科技不为此安全公告提供任何保证或承诺。由于传播、利用此安全公告所提供的信息而造成的任何直接或者间接的后果及损失，均由使用者本人负责，绿盟科技以及安全公告作者不为此承担任何责任。

一、概述

二、重点漏洞概述

三、漏洞防护

Meet The Author