Vulnerabilidades do Oracle Application Server
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Oracle Application Server: 3 registro(s), com versões afetadas e correções.cpe:2.3:a:oracle:application_server
CVE-2020-1967
Alta · 7.5
CWE-476 21/04/2020
Segmentation fault in SSL_check_chain
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).
CVE-2018-5407
Média · 4.7
Exploit público CWE-203 15/11/2018
Observable Discrepancy em Canonical Ubuntu Linux
Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.
CVE-2018-0735
Média · 5.9
CWE-327 29/10/2018
Timing attack against ECDSA signature generation
The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.1a (Affected 1.1.1).