近日,Oracle官方发布了多个安全漏洞的公告,其中Oracle产品本身漏洞143个,影响到Oracle产品的其他厂商漏洞193个。包括Oracle BI Publisher 安全漏洞(CNNVD-202404-2284、CVE-2024-21082)、Oracle Food and Beverage Applications 安全漏洞(CNNVD-202404-2316、CVE-2024-21014)等多个漏洞。成功利用上述漏洞的攻击者可以在目标系统上执行任意代码、获取用户数据、提升权限等。Oracle多个产品和系统受漏洞影响。目前,Oracle官方已经发布了漏洞修复补丁,建议用户及时确认是否受到漏洞影响,尽快采取修补措施。

一、 漏洞介绍

2024年4月16日,Oracle发布了2024年4月份安全更新,共336个漏洞的补丁程序,CNNVD对这些漏洞进行了收录。本次更新主要涵盖了Oracle Mysql 和 Mysql 组件、Oracle PeopleSoft Enterprise PeopleTools、Oracle Java SE 的 Oracle GraalVM、Oracle Database Server、Oracle MySQL、Oracle Fusion Middleware等。CNNVD对其危害等级进行了评价,其中超危漏洞31个,高危漏洞122个,中危漏洞158个,低危漏洞25个。Oracle多个产品和系统版本受漏洞影响,具体影响范围可访问Oracle官方网站查询:

https://www.oracle.com/security-alerts/cpuapr2024.html

二、漏洞详情

此次更新共包括133个新增漏洞的补丁程序,其中超危漏洞5个,高危漏洞26个,中危漏洞86个,低危漏洞16个。

序号

漏洞名称

CNNVD编号

CVE编号

危害等级

官方链接

1

Oracle BI Publisher 安全漏洞

CNNVD-202404-2284

CVE-2024-21082

超危

https://www.oracle.com/security-alerts/cpuapr2024.html

2

Oracle Food and Beverage Applications 安全漏洞

CNNVD-202404-2316

CVE-2024-21014

超危

https://www.oracle.com/security-alerts/cpuapr2024.html

3

Oracle Food and Beverage Applications 安全漏洞

CNNVD-202404-2317

CVE-2024-20997

超危

https://www.oracle.com/security-alerts/cpuapr2024.html

4

Oracle Food and Beverage Applications 安全漏洞

CNNVD-202404-2318

CVE-2024-21010

超危

https://www.oracle.com/security-alerts/cpuapr2024.html

5

Oracle E-Business Suite 安全漏洞

CNNVD-202404-2363

CVE-2024-21071

超危

https://www.oracle.com/security-alerts/cpuapr2024.html

6

Oracle Virtualization 安全漏洞

CNNVD-202404-2199

CVE-2024-21110

高危

https://www.oracle.com/security-alerts/cpuapr2024.html

7

Oracle Virtualization 的 Oracle VM VirtualBox 安全漏洞

CNNVD-202404-2200

CVE-2024-21116

高危

https://www.oracle.com/security-alerts/cpuapr2024.html

8

Oracle Virtualization 安全漏洞

CNNVD-202404-2201

CVE-2024-21111

高危

https://www.oracle.com/security-alerts/cpuapr2024.html

9

Oracle Virtualization 的 Oracle VM VirtualBox 安全漏洞

CNNVD-202404-2202

CVE-2024-21103

高危

https://www.oracle.com/security-alerts/cpuapr2024.html

10

Oracle Virtualization 安全漏洞

CNNVD-202404-2203

CVE-2024-21113

高危

https://www.oracle.com/security-alerts/cpuapr2024.html

11

Oracle Virtualization 的 Oracle VM VirtualBox 安全漏洞

CNNVD-202404-2204

CVE-2024-21114

高危

https://www.oracle.com/security-alerts/cpuapr2024.html

12

Oracle Virtualization 安全漏洞

CNNVD-202404-2205

CVE-2024-21112

高危

https://www.oracle.com/security-alerts/cpuapr2024.html

13

Oracle Virtualization 安全漏洞

CNNVD-202404-2208

CVE-2024-21115

高危

https://www.oracle.com/security-alerts/cpuapr2024.html

14

Oracle Solaris 安全漏洞

CNNVD-202404-2209

CVE-2024-20999

高危

https://www.oracle.com/security-alerts/cpuapr2024.html

15

Oracle Solaris 安全漏洞

CNNVD-202404-2210

CVE-2024-21059

高危

https://www.oracle.com/security-alerts/cpuapr2024.html

16

Oracle Supply Chain Products Suite 安全漏洞

CNNVD-202404-2212

CVE-2024-21092

高危

https://www.oracle.com/security-alerts/cpuapr2024.html

17

Oracle MySQL 的 MySQL Connectors 安全漏洞

CNNVD-202404-2243

CVE-2024-21090

高危

https://www.oracle.com/security-alerts/cpuapr2024.html

18

Oracle BI Publisher 安全漏洞

CNNVD-202404-2277

CVE-2024-21083

高危

https://www.oracle.com/security-alerts/cpuapr2024.html

19

Oracle Fusion Middleware 的 Oracle WebLogic Server 安全漏洞

CNNVD-202404-2304

CVE-2024-21007

高危

https://www.oracle.com/security-alerts/cpuapr2024.html

20

Oracle Fusion Middleware 的 Oracle WebLogic Server 安全漏洞

CNNVD-202404-2306

CVE-2024-21006

高危

https://www.oracle.com/security-alerts/cpuapr2024.html

21

Oracle Food and Beverage Applications 安全漏洞

CNNVD-202404-2315

CVE-2024-20989

高危

https://www.oracle.com/security-alerts/cpuapr2024.html

22

Oracle Enterprise Manager Base Platform 安全漏洞

CNNVD-202404-2319

CVE-2024-21067

高危

https://www.oracle.com/security-alerts/cpuapr2024.html

23

Oracle Construction and Engineering Suite 安全漏洞

CNNVD-202404-2327

CVE-2024-21095

高危

https://www.oracle.com/security-alerts/cpuapr2024.html

24

Oracle E-Business Suite 安全漏洞

CNNVD-202404-2337

CVE-2024-21088

高危

https://www.oracle.com/security-alerts/cpuapr2024.html

25

Oracle E-Business Suite 的 Oracle Marketing 安全漏洞

CNNVD-202404-2346

CVE-2024-21079

高危

https://www.oracle.com/security-alerts/cpuapr2024.html

26

Oracle E-Business Suite 的 Oracle Trade Management 安全漏洞

CNNVD-202404-2351

CVE-2024-21077

高危

https://www.oracle.com/security-alerts/cpuapr2024.html

27

Oracle E-Business Suite 的 Oracle Trade Management 安全漏洞

CNNVD-202404-2354

CVE-2024-21075

高危

https://www.oracle.com/security-alerts/cpuapr2024.html

28

Oracle E-Business Suite 的 Oracle Marketing 安全漏洞

CNNVD-202404-2355

CVE-2024-21078

高危

https://www.oracle.com/security-alerts/cpuapr2024.html

29

Oracle E-Business Suite 安全漏洞

CNNVD-202404-2356

CVE-2024-21076

高危

https://www.oracle.com/security-alerts/cpuapr2024.html

30

Oracle E-Business Suite 安全漏洞

CNNVD-202404-2357

CVE-2024-21074

高危

https://www.oracle.com/security-alerts/cpuapr2024.html

31

Oracle E-Business Suite 安全漏洞

CNNVD-202404-2360

CVE-2024-21073

高危

https://www.oracle.com/security-alerts/cpuapr2024.html

32

Oracle Virtualization 安全漏洞

CNNVD-202404-2195

CVE-2024-21109

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

33

Oracle Virtualization 的 Oracle VM VirtualBox 安全漏洞

CNNVD-202404-2196

CVE-2024-21121

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

34

Oracle Virtualization 安全漏洞

CNNVD-202404-2197

CVE-2024-21106

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

35

Oracle Virtualization 安全漏洞

CNNVD-202404-2198

CVE-2024-21107

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

36

Oracle ZFS Storage Appliance 安全漏洞

CNNVD-202404-2207

CVE-2024-21104

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

37

Oracle Supply Chain Products Suite 安全漏洞

CNNVD-202404-2211

CVE-2024-21091

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

38

Oracle PeopleSoft Enterprise PeopleTools 安全漏洞

CNNVD-202404-2213

CVE-2024-21097

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

39

Oracle PeopleSoft 安全漏洞

CNNVD-202404-2214

CVE-2024-21070

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

40

Oracle PeopleSoft Products 安全漏洞

CNNVD-202404-2215

CVE-2024-21063

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

41

Oracle PeopleSoft Enterprise PeopleTools 安全漏洞

CNNVD-202404-2216

CVE-2024-21065

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

42

Oracle MySQL 安全漏洞

CNNVD-202404-2219

CVE-2024-21013

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

43

Oracle MySQL 安全漏洞

CNNVD-202404-2220

CVE-2024-21008

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

44

Oracle MySQL 安全漏洞

CNNVD-202404-2221

CVE-2024-21096

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

45

Oracle MySQL 安全漏洞

CNNVD-202404-2222

CVE-2024-21057

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

46

Oracle MySQL 安全漏洞

CNNVD-202404-2223

CVE-2024-21062

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

47

Oracle MySQL 安全漏洞

CNNVD-202404-2224

CVE-2024-21055

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

48

Oracle MySQL 安全漏洞

CNNVD-202404-2225

CVE-2024-21054

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

49

Oracle MySQL 安全漏洞

CNNVD-202404-2226

CVE-2024-21009

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

50

Oracle MySQL 安全漏洞

CNNVD-202404-2227

CVE-2024-20993

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

51

Oracle MySQL 安全漏洞

CNNVD-202404-2228

CVE-2024-20998

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

52

Oracle MySQL 安全漏洞

CNNVD-202404-2229

CVE-2024-21087

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

53

Oracle MySQL 安全漏洞

CNNVD-202404-2230

CVE-2024-21060

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

54

Oracle MySQL 安全漏洞

CNNVD-202404-2231

CVE-2024-21056

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

55

Oracle MySQL 安全漏洞

CNNVD-202404-2232

CVE-2024-21053

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

56

Oracle MySQL 安全漏洞

CNNVD-202404-2233

CVE-2024-21052

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

57

Oracle MySQL 安全漏洞

CNNVD-202404-2234

CVE-2024-21051

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

58

Oracle MySQL 安全漏洞

CNNVD-202404-2235

CVE-2024-21050

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

59

Oracle MySQL 安全漏洞

CNNVD-202404-2236

CVE-2024-21049

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

60

Oracle MySQL 安全漏洞

CNNVD-202404-2237

CVE-2024-21069

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

61

Oracle MySQL 安全漏洞

CNNVD-202404-2238

CVE-2024-21061

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

62

Oracle MySQL 安全漏洞

CNNVD-202404-2239

CVE-2024-21047

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

63

Oracle MySQL 安全漏洞

CNNVD-202404-2240

CVE-2024-21102

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

64

Oracle MySQL 安全漏洞

CNNVD-202404-2241

CVE-2024-20994

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

65

Oracle MySQL 安全漏洞

CNNVD-202404-2242

CVE-2024-21015

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

66

Oracle Business Intelligence Enterprise Edition 安全漏洞

CNNVD-202404-2268

CVE-2024-21099

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

67

Oracle Business Intelligence Enterprise Edition 安全漏洞

CNNVD-202404-2271

CVE-2024-21001

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

68

Oracle Business Intelligence Enterprise Edition 安全漏洞

CNNVD-202404-2273

CVE-2024-21064

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

69

Oracle BI Publisher 安全漏洞

CNNVD-202404-2275

CVE-2024-21084

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

70

Oracle Fusion Middleware 安全漏洞

CNNVD-202404-2287

CVE-2024-20992

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

71

Oracle Fusion Middleware 的 Oracle Outside In Technology 安全漏洞

CNNVD-202404-2290

CVE-2024-21118

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

72

Oracle Fusion Middleware 的 Oracle Outside In Technology 安全漏洞

CNNVD-202404-2292

CVE-2024-21120

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

73

Oracle Fusion Middleware 的 Oracle Outside In Technology 安全漏洞

CNNVD-202404-2294

CVE-2024-21117

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

74

Oracle Fusion Middleware 的 Oracle Outside In Technology 安全漏洞

CNNVD-202404-2297

CVE-2024-21119

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

75

Oracle Fusion Middleware 的 Oracle HTTP Server 安全漏洞

CNNVD-202404-2298

CVE-2024-20991

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

76

Oracle E-Business Suite 的 Oracle Web Applications Desktop Integrator 安全漏洞

CNNVD-202404-2320

CVE-2024-21048

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

77

Oracle Commerce 的 Oracle Commerce Platform 安全漏洞

CNNVD-202404-2321

CVE-2024-21100

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

78

Oracle E-Business Suite 的 Oracle CRM Technical Foundation 安全漏洞

CNNVD-202404-2322

CVE-2024-21086

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

79

Oracle E-Business Suite 的 Oracle Partner Management 安全漏洞

CNNVD-202404-2323

CVE-2024-21081

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

80

Oracle E-Business Suite 安全漏洞

CNNVD-202404-2324

CVE-2024-20990

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

81

Oracle E-Business Suite 的 Oracle Installed Base 安全漏洞

CNNVD-202404-2325

CVE-2024-21072

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

82

Oracle E-Business Suite 安全漏洞

CNNVD-202404-2326

CVE-2024-21046

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

83

Oracle E-Business Suite 安全漏洞

CNNVD-202404-2328

CVE-2024-21045

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

84

Oracle Database Server 安全漏洞

CNNVD-202404-2329

CVE-2024-21093

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

85

Oracle E-Business Suite 安全漏洞

CNNVD-202404-2330

CVE-2024-21044

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

86

Oracle E-Business Suite 安全漏洞

CNNVD-202404-2331

CVE-2024-21043

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

87

Oracle E-Business Suite 安全漏洞

CNNVD-202404-2332

CVE-2024-21042

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

88

Oracle E-Business Suite 安全漏洞

CNNVD-202404-2333

CVE-2024-21041

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

89

Oracle E-Business Suite 安全漏洞

CNNVD-202404-2334

CVE-2024-21040

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

90

Oracle E-Business Suite 安全漏洞

CNNVD-202404-2335

CVE-2024-21089

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

91

Oracle E-Business Suite 安全漏洞

CNNVD-202404-2336

CVE-2024-21039

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

92

Oracle E-Business Suite 安全漏洞

CNNVD-202404-2338

CVE-2024-21038

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

93

Oracle E-Business Suite 安全漏洞

CNNVD-202404-2339

CVE-2024-21037

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

94

Oracle E-Business Suite 安全漏洞

CNNVD-202404-2340

CVE-2024-21036

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

95

Oracle E-Business Suite 安全漏洞

CNNVD-202404-2341

CVE-2024-21035

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

96

Oracle E-Business Suite 安全漏洞

CNNVD-202404-2342

CVE-2024-21034

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

97

Oracle E-Business Suite 安全漏洞

CNNVD-202404-2343

CVE-2024-21033

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

98

Oracle E-Business Suite 安全漏洞

CNNVD-202404-2344

CVE-2024-21032

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

99

Oracle E-Business Suite 安全漏洞

CNNVD-202404-2345

CVE-2024-21031

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

100

Oracle E-Business Suite 的 Oracle Applications Framework 安全漏洞

CNNVD-202404-2347

CVE-2024-21080

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

101

Oracle E-Business Suite 安全漏洞

CNNVD-202404-2348

CVE-2024-21030

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

102

Oracle E-Business Suite 安全漏洞

CNNVD-202404-2349

CVE-2024-21029

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

103

Oracle E-Business Suite 安全漏洞

CNNVD-202404-2350

CVE-2024-21028

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

104

Oracle E-Business Suite 安全漏洞

CNNVD-202404-2352

CVE-2024-21027

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

105

Oracle E-Business Suite 安全漏洞

CNNVD-202404-2353

CVE-2024-21026

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

106

Oracle E-Business Suite 安全漏洞

CNNVD-202404-2358

CVE-2024-21025

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

107

Oracle E-Business Suite 安全漏洞

CNNVD-202404-2359

CVE-2024-21024

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

108

Oracle E-Business Suite 安全漏洞

CNNVD-202404-2361

CVE-2024-21023

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

109

Oracle E-Business Suite 安全漏洞

CNNVD-202404-2362

CVE-2024-21021

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

110

Oracle E-Business Suite 安全漏洞

CNNVD-202404-2364

CVE-2024-21020

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

111

Oracle E-Business Suite 安全漏洞

CNNVD-202404-2365

CVE-2024-21022

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

112

Oracle E-Business Suite 安全漏洞

CNNVD-202404-2366

CVE-2024-21018

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

113

Oracle E-Business Suite 安全漏洞

CNNVD-202404-2367

CVE-2024-21017

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

114

Oracle E-Business Suite 安全漏洞

CNNVD-202404-2368

CVE-2024-21019

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

115

Oracle Database Server 安全漏洞

CNNVD-202404-2369

CVE-2024-21066

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

116

Oracle Database Server 安全漏洞

CNNVD-202404-2370

CVE-2024-21058

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

117

Oracle E-Business Suite 安全漏洞

CNNVD-202404-2371

CVE-2024-21016

中危

https://www.oracle.com/security-alerts/cpuapr2024.html

118

Oracle Virtualization 安全漏洞

CNNVD-202404-2194

CVE-2024-21108

低危

https://www.oracle.com/security-alerts/cpuapr2024.html

119

Oracle Solaris 安全漏洞

CNNVD-202404-2206

CVE-2024-21105

低危

https://www.oracle.com/security-alerts/cpuapr2024.html

120

Oracle MySQL 安全漏洞

CNNVD-202404-2217

CVE-2024-21101

低危

https://www.oracle.com/security-alerts/cpuapr2024.html

121

Oracle MySQL 安全漏洞

CNNVD-202404-2218

CVE-2024-21000

低危

https://www.oracle.com/security-alerts/cpuapr2024.html

122

Oracle Java SE 安全漏洞

CNNVD-202404-2244

CVE-2024-21004

低危

https://www.oracle.com/security-alerts/cpuapr2024.html

123

Oracle Java SE 安全漏洞

CNNVD-202404-2245

CVE-2024-21002

低危

https://www.oracle.com/security-alerts/cpuapr2024.html

124

Oracle Java SE 和 Oracle GraalVM 安全漏洞

CNNVD-202404-2246

CVE-2024-21005

低危

https://www.oracle.com/security-alerts/cpuapr2024.html

125

Oracle Java SE 安全漏洞

CNNVD-202404-2247

CVE-2024-21003

低危

https://www.oracle.com/security-alerts/cpuapr2024.html

126

Oracle Java SE 和Oracle GraalVM 安全漏洞

CNNVD-202404-2248

CVE-2024-21012

低危

https://www.oracle.com/security-alerts/cpuapr2024.html

127

Oracle Java SE 安全漏洞

CNNVD-202404-2249

CVE-2024-21094

低危

https://www.oracle.com/security-alerts/cpuapr2024.html

128

Oracle Java SE 安全漏洞

CNNVD-202404-2250

CVE-2024-21068

低危

https://www.oracle.com/security-alerts/cpuapr2024.html

129

Oracle Java SE 安全漏洞

CNNVD-202404-2251

CVE-2024-21011

低危

https://www.oracle.com/security-alerts/cpuapr2024.html

130

Oracle Java SE 安全漏洞

CNNVD-202404-2252

CVE-2024-21085

低危

https://www.oracle.com/security-alerts/cpuapr2024.html

131

Oracle Java SE 安全漏洞

CNNVD-202404-2253

CVE-2024-21098

低危

https://www.oracle.com/security-alerts/cpuapr2024.html

132

Oracle Java SE 的 Oracle GraalVM 安全漏洞

CNNVD-202404-2256

CVE-2024-20954

低危

https://www.oracle.com/security-alerts/cpuapr2024.html

133

Oracle Database Server 安全漏洞

CNNVD-202404-2372

CVE-2024-20995

低危

https://www.oracle.com/security-alerts/cpuapr2024.html

此次更新共包括10个更新漏洞的补丁程序,其中高危漏洞3个,中危漏洞4个,低危漏洞3个。

序号

漏洞名称

CNNVD编号

CVE编号

危害等级

官方链接

1

Oracle部分产品 安全漏洞

CNNVD-202401-1563

CVE-2024-20918

高危

https://www.oracle.com/security-alerts/cpujan2024.html

2

Oracle部分产品 安全漏洞

CNNVD-202401-1546

CVE-2024-20932

高危

https://www.oracle.com/security-alerts/cpujan2024.html

3

Oracle部分产品 安全漏洞

CNNVD-202401-1537

CVE-2024-20952

高危

https://www.oracle.com/security-alerts/cpujan2024.html

4

Oracle Java SE 安全漏洞

CNNVD-202401-1582

CVE-2024-20919

中危

https://www.oracle.com/security-alerts/cpujan2024.html

5

Oracle Java SE 安全漏洞

CNNVD-202401-1583

CVE-2024-20921

中危

https://www.oracle.com/security-alerts/cpujan2024verbose.html

6

Oracle Java SE和Oracle GraalVM 安全漏洞

CNNVD-202401-1548

CVE-2024-20926

中危

https://www.oracle.com/security-alerts/cpujan2024.html

7

Oracle Java SE 安全漏洞

CNNVD-202401-1584

CVE-2024-20945

中危

https://www.oracle.com/security-alerts/cpujan2024.html

8

Oracle部分产品 安全漏洞

CNNVD-202401-1556

CVE-2024-20922

低危

https://www.oracle.com/security-alerts/cpujan2024.html

9

Oracle部分产品安全漏洞

CNNVD-202401-1675

CVE-2024-20923

低危

https://www.oracle.com/security-alerts/cpujan2024.html

10

Oracle Java SE和Oracle GraalVM 安全漏洞

CNNVD-202401-1673

CVE-2024-20925

低危

https://www.oracle.com/security-alerts/cpujan2024.html

此次更新共包括193个影响Oracle产品的其他厂商漏洞的补丁程序,其中超危漏洞26个,高危漏洞93个,中危漏洞68个,低危漏洞6个。

序号

漏洞名称

CNNVD编号

CVE编号

危害等级

厂商

官方链接

1

Terracotta Quartz Scheduler 代码问题漏洞

CNNVD-201907-1383

CVE-2019-13990

超危

softwareag

http://www.quartz-scheduler.org/

2

Dell BSAFE Micro Edition Suite和Dell BSAFE 输入验证错误漏洞

CNNVD-202207-838

CVE-2020-29508

超危

Dell

https://www.dell.com/support/kbdoc/en-us/000181115/dsa-2020-286-dell-bsafe-crypto-c-micro-edition-4-1-5-and-dell-bsafe-micro-edition-suite-4-6-multiple-security-vulnerabilities

3

Dell BSAFE 安全特征问题漏洞

CNNVD-202207-834

CVE-2020-35163

超危

Dell

https://www.dell.com/support/kbdoc/en-us/000181115/dsa-2020-286-dell-bsafe-crypto-c-micro-edition-4-1-5-and-dell-bsafe-micro-edition-suite-4-6-multiple-security-vulnerabilities

4

Dell BSAFE 安全漏洞

CNNVD-202207-832

CVE-2020-35166

超危

Dell

https://www.dell.com/support/kbdoc/en-us/000181115/dsa-2020-286-dell-bsafe-crypto-c-micro-edition-4-1-5-and-dell-bsafe-micro-edition-suite-4-6-multiple-security-vulnerabilities

5

Dell BSAFE 安全漏洞

CNNVD-202207-831

CVE-2020-35167

超危

Dell

https://www.dell.com/support/kbdoc/en-us/000181115/dsa-2020-286-dell-bsafe-crypto-c-micro-edition-4-1-5-and-dell-bsafe-micro-edition-suite-4-6-multiple-security-vulnerabilities

6

Dell BSAFE 安全漏洞

CNNVD-202207-828

CVE-2020-35168

超危

Dell

https://www.dell.com/support/kbdoc/en-us/000181115/dsa-2020-286-dell-bsafe-crypto-c-micro-edition-4-1-5-and-dell-bsafe-micro-edition-suite-4-6-multiple-security-vulnerabilities

7

handlebars 安全漏洞

CNNVD-202104-686

CVE-2021-23369

超危

个人开发者

https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427

8

handlebars 安全漏洞

CNNVD-202105-130

CVE-2021-23383

超危

个人开发者

https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427

9

Apache DB DdlUtils 代码问题漏洞

CNNVD-202109-1960

CVE-2021-41616

超危

Apache基金会

https://lists.apache.org/thread.html/r3d7a8303a820144f5e2d1fd0b067e18d419421b58346b53b58d3fa72%40%3Cannounce.apache.org%3E

10

iText 命令注入漏洞

CNNVD-202112-1333

CVE-2021-43113

超危

个人开发者

https://github.com/itext/itext7/releases/tag/7.1.17

11

SnakeYAML 代码问题漏洞

CNNVD-202212-1820

CVE-2022-1471

超危

个人开发者

https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2

12

Dell BSAFE 安全漏洞

CNNVD-202402-197

CVE-2022-34381

超危

Dell

https://www.dell.com/support/kbdoc/en-us/000203278/dsa-2022-208-dell-bsafe-ssl-j-6-5-and-7-1-and-dell-bsafe-crypto-j-6-2-6-1-and-7-0-security-vulnerability

13

HSQLDB 安全漏洞

CNNVD-202210-196

CVE-2022-41853

超危

The HSQL Development Group

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50212#c7

14

Apache Commons Text 代码注入漏洞

CNNVD-202210-790

CVE-2022-42889

超危

Apache基金会

https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om

15

Apache Commons BCEL 缓冲区错误漏洞

CNNVD-202211-2199

CVE-2022-42920

超危

Apache基金会

https://lists.apache.org/thread/lfxk7q8qmnh5bt9jm6nmjlv5hsxjhrz4

16

Apache SOAP 访问控制错误漏洞

CNNVD-202211-2683

CVE-2022-45378

超危

Apache

https://lists.apache.org/thread/g4l64s283njhnph2otx7q4gs2j952d31

17

Apache Derby 注入漏洞

CNNVD-202311-1655

CVE-2022-46337

超危

Apache基金会

https://lists.apache.org/thread/q23kvvtoohgzwybxpwozmvvk17rp0td3

18

Apache CXF 代码问题漏洞

CNNVD-202212-3143

CVE-2022-46364

超危

Apache基金会

https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c

19

VMware Spring Security 安全漏洞

CNNVD-202307-1680

CVE-2023-34034

超危

VMware

https://spring.io/security/cve-2023-34034

20

curl 缓冲区错误漏洞

CNNVD-202310-917

CVE-2023-38545

超危

curl

https://github.com/curl/curl/commit/fb4415d8aee6c1

21

Apple Safari 代码问题漏洞

CNNVD-202309-2063

CVE-2023-41993

超危

Apple

https://support.apple.com/en-us/HT213930

22

npm IP Package 代码问题漏洞

CNNVD-202402-689

CVE-2023-42282

超危

npm

https://www.npmjs.com/package/ip

23

Apache ZooKeeper 安全漏洞

CNNVD-202310-856

CVE-2023-44981

超危

Apache基金会

https://lists.apache.org/thread/wf0yrk84dg1942z1o74kd8nycg6pgm5b

24

Apache ActiveMQ 代码问题漏洞

CNNVD-202310-2332

CVE-2023-46604

超危

Apache基金会

https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt

25

Perl 安全漏洞

CNNVD-202312-067

CVE-2023-47100

超危

Perl

https://github.com/Perl/perl5/commit/ff1f9f59360afeebd6f75ca1502f5c3ebf077da3

26

PostgreSQL JDBC Driver 安全漏洞

CNNVD-202402-1534

CVE-2024-1597

超危

PostgreSQL

https://github.com/pgjdbc/pgjdbc/releases/tag/REL42.7.2

27

Apache MINA 安全漏洞

CNNVD-201910-048

CVE-2019-0231

高危

Apache基金会

http://mina.apache.org/mina-project/index.html#mina-211-mina-2021-released-posted-on-april-14-2019

28

jackson-mapper-asl 代码问题漏洞

CNNVD-201911-1110

CVE-2019-10172

高危

个人开发者

https://mvnrepository.com/artifact/org.codehaus.jackson

29

Red Hat Hibernate ORM SQL注入漏洞

CNNVD-202011-1706

CVE-2020-25638

高危

Red Hat

https://hibernate.org/

30

Dell BSAFE 安全漏洞

CNNVD-202207-833

CVE-2020-35164

高危

Dell

https://www.dell.com/support/kbdoc/en-us/000181115/dsa-2020-286-dell-bsafe-crypto-c-micro-edition-4-1-5-and-dell-bsafe-micro-edition-suite-4-6-multiple-security-vulnerabilities

31

Python 输入验证错误漏洞

CNNVD-202208-3716

CVE-2021-28861

高危

Python

https://bugs.python.org/issue43223

32

Perl 代码问题漏洞

CNNVD-202108-807

CVE-2021-36770

高危

Perl

https://access.redhat.com/security/cve/cve-2021-36770

33

Certifi 数据伪造问题漏洞

CNNVD-202212-2660

CVE-2022-23491

高危

Certifi

https://github.com/certifi/python-certifi/security/advisories/GHSA-43fp-rhv2-5gv8

34

nekohtml资源管理错误漏洞

CNNVD-202204-2918

CVE-2022-24839

高危

个人开发者

https://github.com/sparklemotion/nekohtml/commit/a800fce3b079def130ed42a408ff1d09f89e773d

35

Google protobuf 安全漏洞

CNNVD-202210-769

CVE-2022-3171

高危

Google

https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-h4h5-3hr4-j3g2

36

Apache Xalan 输入验证错误漏洞

CNNVD-202207-1617

CVE-2022-34169

高危

Apache基金会

https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kyw

37

XStream 缓冲区错误漏洞

CNNVD-202209-1230

CVE-2022-40152

高危

XStream

https://github.com/x-stream/xstream/issues/304

38

Apache XML Graphics Batik 代码问题漏洞

CNNVD-202210-1712

CVE-2022-41704

高危

Apache基金会

https://lists.apache.org/thread/hplhx0o74jb7blj39fm4kw3otcnjd6xf

39

FasterXML jackson-databind 代码问题漏洞

CNNVD-202210-007

CVE-2022-42003

高危

FasterXML

https://github.com/FasterXML/jackson-databind/commit/d78d00ee7b5245b93103fef3187f70543d67ca33

40

FasterXML jackson-databind 代码问题漏洞

CNNVD-202210-006

CVE-2022-42004

高危

FasterXML

https://github.com/FasterXML/jackson-databind/commit/063183589218fec19a9293ed2f17ec53ea80ba88

41

Apache XML Graphics Batik 代码问题漏洞

CNNVD-202210-1707

CVE-2022-42890

高危

Apache基金会

https://lists.apache.org/thread/pkvhy0nsj1h1mlon008wtzhosbtxjwly

42

Apache XML Graphics Batik 代码问题漏洞

CNNVD-202308-1802

CVE-2022-44729

高危

Apache基金会

https://lists.apache.org/thread/hco2nw1typoorz33qzs0fcdx0ws6d6j2

43

Hutool 缓冲区错误漏洞

CNNVD-202212-3131

CVE-2022-45688

高危

Dromara社区

https://github.com/dromara/hutool/issues/2748

44

Apache Ivy 代码问题漏洞

CNNVD-202308-1684

CVE-2022-46751

高危

Apache基金会

https://lists.apache.org/thread/1dj60hg5nr36kjr4p1100dwjrqookps8

45

UnRAR 后置链接漏洞

CNNVD-202308-425

CVE-2022-48579

高危

个人开发者

https://github.com/pmachapman/unrar/commit/2ecab6bb5ac4f3b88f270218445496662020205f#diff-ca3086f578522062d7e390ed2cd7e10f646378a8b8cbf287a6e4db5966df68ee

46

OpenSSL 信任管理问题漏洞

CNNVD-202303-1681

CVE-2023-0464

高危

OpenSSL

https://www.openssl.org/news/secadv/20230322.txt

47

Red Hat JBoss Enterprise Application Platform 安全漏洞

CNNVD-202303-798

CVE-2023-1108

高危

Red Hat

https://github.com/ICEPAY/REST-API-NET/commit/61f6b8758e5c971abff5f901cfa9f231052b775f

48

netplex json-smart 安全漏洞

CNNVD-202303-1658

CVE-2023-1370

高危

netplex

https://netplex.github.io/json-smart/

49

Jettison 安全漏洞

CNNVD-202303-1656

CVE-2023-1436

高危

Jettison

https://research.jfrog.com/vulnerabilities/jettison-json-array-dos-xray-427911/

50

Spring Framework 安全漏洞

CNNVD-202303-2401

CVE-2023-20860

高危

Spring

https://spring.io/security/cve-2023-20860

51

ModSecurity 安全漏洞

CNNVD-202301-1585

CVE-2023-24021

高危

个人开发者

https://github.com/SpiderLabs/ModSecurity/pull/2857/commits/4324f0ac59f8225aa44bc5034df60dbeccd1d334

52

Apache Commons FileUpload 安全漏洞

CNNVD-202302-1610

CVE-2023-24998

高危

Apache基金会

https://lists.apache.org/thread/4xl4l09mhwg4vgsk7dxqogcjrobrrdoy

53

OpenCV 代码问题漏洞

CNNVD-202305-852

CVE-2023-2617

高危

OpenCV

https://github.com/opencv/opencv_contrib/pull/3480

54

OpenCV 安全漏洞

CNNVD-202305-851

CVE-2023-2618

高危

OpenCV

https://github.com/opencv/opencv_contrib/pull/3484/commits/2b62ff6181163eea029ed1cab11363b4996e9cd6

55

Intel oneAPI Toolkits 代码问题漏洞

CNNVD-202308-1031

CVE-2023-28823

高危

Intel

http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00890.html

56

glib2 资源管理错误漏洞

CNNVD-202306-1169

CVE-2023-29499

高危

GNOME

https://gitlab.gnome.org/GNOME/glib/

57

Google Guava 安全漏洞

CNNVD-202306-1141

CVE-2023-2976

高危

Google

https://github.com/google/guava

58

Apache HTTP Server 缓冲区错误漏洞

CNNVD-202310-1640

CVE-2023-31122

高危

Apache基金会

https://httpd.apache.org/security/vulnerabilities_24.html

59

Red Hat Undertow 安全漏洞

CNNVD-202308-506

CVE-2023-3223

高危

Red Hat

https://undertow.io/

60

glib2 资源管理错误漏洞

CNNVD-202306-1170

CVE-2023-32636

高危

GNOME

https://gitlab.gnome.org/GNOME/glib/

61

glib2 缓冲区错误漏洞

CNNVD-202306-1172

CVE-2023-32643

高危

GNOME

https://gitlab.gnome.org/GNOME/glib/

62

Spring Framework 安全漏洞

CNNVD-202311-2123

CVE-2023-34053

高危

Spring团队

https://github.com/spring-projects/spring-framework/releases/tag/v6.0.

63

Apache Tomcat 安全漏洞

CNNVD-202306-1525

CVE-2023-34981

高危

Apache基金会

https://lists.apache.org/thread/j1ksjh9m9gx1q60rtk1sbzmxhvj5h5qz

64

Jenkins 跨站请求伪造漏洞

CNNVD-202306-1089

CVE-2023-35141

高危

Jenkins

https://www.jenkins.io/security/advisory/2023-06-14/#SECURITY-3135

65

Okio 安全漏洞

CNNVD-202307-1161

CVE-2023-3635

高危

square

https://github.com/square/okio/commit/81bce1a30af244550b0324597720e4799281da7b

66

Eclipse Jetty 资源管理错误漏洞

CNNVD-202310-691

CVE-2023-36478

高危

Eclipse基金会

https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgh7-54f2-x98r

67

Python 安全漏洞

CNNVD-202306-1804

CVE-2023-36632

高危

Python基金会

https://docs.python.org/3/library/email.html

68

HCL BigFix Platform 输入验证错误漏洞

CNNVD-202310-848

CVE-2023-37536

高危

HCL Technologies

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0107791

69

curl 安全漏洞

CNNVD-202309-1067

CVE-2023-38039

高危

curl

https://github.com/curl/curl

70

python-cryptography 信任管理问题漏洞

CNNVD-202307-1332

CVE-2023-38325

高危

Cryptographic团队

https://github.com/pyca/cryptography/issues/9207

71

MIT Kerberos 资源管理错误漏洞

CNNVD-202308-1454

CVE-2023-39975

高危

MIT

https://github.com/krb5/krb5/commit/88a1701b423c13991a8064feeb26952d3641d840

72

Eclipse Parsson 安全漏洞

CNNVD-202311-268

CVE-2023-4043

高危

Eclipse基金会

https://github.com/eclipse-ee4j/parsson/commit/9dd5ad5f871f7b93654073a3f8ce3e1d9b8d9b31

73

Redis 安全漏洞

CNNVD-202401-776

CVE-2023-41056

高危

Redis Labs

https://github.com/redis/redis/commit/e351099e1119fb89496be578f5232c61ce300224

74

Apple iOS 和 iPadOS 安全漏洞

CNNVD-202309-2265

CVE-2023-41074

高危

Apple

https://support.apple.com/en-us/HT213938

75

Python 代码问题漏洞

CNNVD-202308-1930

CVE-2023-41105

高危

Python基金会

https://github.com/python/cpython/pull/107982

76

Apple Safari 安全漏洞

CNNVD-202311-2397

CVE-2023-42917

高危

Apple

https://support.apple.com/en-us/HT214033

77

Jenkins 安全漏洞

CNNVD-202309-1972

CVE-2023-43496

高危

Jenkins

https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3072

78

Jenkins 代码问题漏洞

CNNVD-202309-1971

CVE-2023-43497

高危

Jenkins

https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3073

79

Jenkins 安全漏洞

CNNVD-202309-1970

CVE-2023-43498

高危

Jenkins

https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3073

80

Apache HTTP Server 资源管理错误漏洞

CNNVD-202310-1641

CVE-2023-43622

高危

Apache基金会

https://httpd.apache.org/security/vulnerabilities_24.html

81

urllib3 信息泄露漏洞

CNNVD-202310-281

CVE-2023-43804

高危

个人开发者

https://github.com/urllib3/urllib3/security/advisories/GHSA-v845-jxx5-vc9f

82

Pillow 安全漏洞

CNNVD-202311-282

CVE-2023-44271

高危

个人开发者

https://github.com/python-pillow/Pillow/commit/1fe1bb49c452b0318cad12ea9d97c3bef188e9a7

83

Apache HTTP/2 资源管理错误漏洞

CNNVD-202310-667

CVE-2023-44487

高危

Apache基金会

https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q

84

OpenTelemetry-Go Contrib 安全漏洞

CNNVD-202310-955

CVE-2023-45142

高危

OpenTelemetry

https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-5r5m-65gx-7vrh

85

Plotly.js 安全漏洞

CNNVD-202401-128

CVE-2023-46308

高危

个人开发者

https://github.com/plotly/plotly.js/releases/tag/v2.25.2

86

shadow 安全漏洞

CNNVD-202310-843

CVE-2023-4641

高危

个人开发者

https://github.com/shadow-maint/shadow/commit/65c88a43a23c2391dcc90c0abda3e839e9c57904

87

Apache Tomcat 环境问题漏洞

CNNVD-202311-2168

CVE-2023-46589

高危

Apache基金会

https://lists.apache.org/thread/0rqq6ktozqc42ro8hhxdmmdjm1k1tpxr

88

Perl 安全漏洞

CNNVD-202311-2025

CVE-2023-47038

高危

PERL社区

https://bugzilla.redhat.com/show_bug.cgi?id=2249523

89

Perl 安全漏洞

CNNVD-202311-2026

CVE-2023-47039

高危

PERL社区

https://www.perl.org/

90

OpenSSL 安全漏洞

CNNVD-202309-665

CVE-2023-4807

高危

OpenSSL

https://www.openssl.org/news/secadv/20230908.txt

91

Google Chrome 缓冲区错误漏洞

CNNVD-202309-784

CVE-2023-4863

高危

Google

https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html

92

glibc 缓冲区错误漏洞

CNNVD-202310-197

CVE-2023-4911

高危

GNU社区

https://www.gnu.org/software/libc/

93

Apache Solr 安全漏洞

CNNVD-202402-792

CVE-2023-50298

高危

Apache

https://solr.apache.org/security.html#cve-2023-50298-apache-solr-can-expose-zookeeper-credentials-via-streaming-expressions

94

Apache Solr 代码问题漏洞

CNNVD-202402-791

CVE-2023-50386

高危

Apache

https://solr.apache.org/security.html#cve-2023-50386-apache-solr-backuprestore-apis-allow-for-deployment-of-executables-in-malicious-configsets

95

JSON-Java 安全漏洞

CNNVD-202310-951

CVE-2023-5072

高危

个人开发者

https://github.com/stleary/JSON-java/

96

Jasper 安全漏洞

CNNVD-202401-1315

CVE-2023-51257

高危

Jasper

https://github.com/jasper-software/jasper/commit/aeef5293c978158255ad4f127089644745602f2a

97

GNU C Library 安全漏洞

CNNVD-202309-2162

CVE-2023-5156

高危

GNU社区

https://sourceware.org/bugzilla/show_bug.cgi?id=30884

98

jose4j 安全漏洞

CNNVD-202402-2688

CVE-2023-51775

高危

Bitbucket

https://bitbucket.org/b_c/jose4j/downloads/

99

Connect2id Nimbus JOSE+JWT 安全漏洞

CNNVD-202402-845

CVE-2023-52428

高危

Connect2id

https://connect2id.com/products/nimbus-jose-jwt

100

OpenSSL 安全漏洞

CNNVD-202310-1871

CVE-2023-5363

高危

OpenSSL团队

https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=0df40630850fb2740e6be6890bb905d3fc623b2d

101

Red Hat Undertow 安全漏洞

CNNVD-202312-977

CVE-2023-5379

高危

Red Hat

https://bugzilla.redhat.com/show_bug.cgi?id=2242099

102

glibc 缓冲区错误漏洞

CNNVD-202401-2632

CVE-2023-6246

高危

个人开发者

https://github.com/kraj/glibc/releases/tag/glibc-2.37

103

logback 代码问题漏洞

CNNVD-202311-2206

CVE-2023-6378

高危

Quality Open Software

https://logback.qos.ch/download.html

104

Quality Open Software Logback 安全漏洞

CNNVD-202312-277

CVE-2023-6481

高危

Quality Open Software

https://logback.qos.ch/news.html

105

glibc 缓冲区错误漏洞

CNNVD-202401-2633

CVE-2023-6779

高危

个人开发者

https://github.com/kraj/glibc/releases/tag/glibc-2.38

106

Red Hat Undertow 资源管理错误漏洞

CNNVD-202402-1551

CVE-2024-1635

高危

Red Hat

https://undertow.io/

107

runc 安全漏洞

CNNVD-202401-2725

CVE-2024-21626

高危

个人开发者

https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv

108

Amazon Ion 安全漏洞

CNNVD-202401-216

CVE-2024-21634

高危

Amazon

https://github.com/amazon-ion/ion-java/security/advisories/GHSA-264p-99wq-f4j6

109

Node.js 安全漏洞

CNNVD-202402-1466

CVE-2024-21892

高危

Node.js

https://nodejs.org/en/blog/vulnerability/february-2024-security-releases/#code-injection-and-privilege-escalation-through-linux-capabilities-cve-2024-21892---high

110

Node.js 安全漏洞

CNNVD-202402-1467

CVE-2024-22019

高危

Node.js

https://nodejs.org/en/blog/vulnerability/february-2024-security-releases/#reading-unprocessed-http-request-with-unbounded-chunk-extension-allows-dos-attacks-cve-2024-22019---high

111

Eclipse Jetty 安全漏洞

CNNVD-202402-2103

CVE-2024-22201

高危

Eclipse

https://github.com/jetty/jetty.project/security/advisories/GHSA-rggv-cv7r-mw98

112

Spring Framework 安全漏洞

CNNVD-202401-1957

CVE-2024-22233

高危

Spring

https://spring.io/security/cve-2024-22233/

113

Spring Framework 安全漏洞

CNNVD-202402-1929

CVE-2024-22243

高危

Spring

https://spring.io/projects/spring-framework#support

114

VMware Spring Security 安全漏洞

CNNVD-202403-1650

CVE-2024-22257

高危

VMware

https://spring.io/security/cve-2024-22257

115

Spring Framework 安全漏洞

CNNVD-202403-1543

CVE-2024-22259

高危

Spring

https://spring.io/security/cve-2024-22259

116

Apache Tomcat 安全漏洞

CNNVD-202403-1180

CVE-2024-23672

高危

Apache

https://lists.apache.org/thread/cmpswfx6tj4s7x0nxxosvfqs11lvdx2f

117

Apache Tomcat 输入验证错误漏洞

CNNVD-202403-1179

CVE-2024-24549

高危

Apache

https://lists.apache.org/thread/4c50rmomhbbsdgfjsgwlb51xdwfjdcvg

118

libxml2 安全漏洞

CNNVD-202402-242

CVE-2024-25062

高危

个人开发者

https://gitlab.gnome.org/GNOME/libxml2/-/tags

119

python-cryptography 安全漏洞

CNNVD-202402-1783

CVE-2024-26130

高危

Cryptographic

https://github.com/pyca/cryptography/commit/97d231672763cdb5959a3b191e692a362f1b9e55

120

Apache Ant 安全漏洞

CNNVD-202107-983

CVE-2021-36373

中危

Apache基金会

https://ant.apache.org/

121

Apache Ant 安全漏洞

CNNVD-202107-984

CVE-2021-36374

中危

Apache基金会

https://ant.apache.org/

122

Apache Commons Net 输入验证错误漏洞

CNNVD-202212-2188

CVE-2021-37533

中危

Apache基金会

https://lists.apache.org/thread/o6yn9r9x6s94v97264hmgol1sf48mvx7

123

JetBrains Kotlin 安全特征问题漏洞

CNNVD-202202-606

CVE-2022-24329

中危

JetBrains

http://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021

124

MetadataExtractor 安全漏洞

CNNVD-202202-1859

CVE-2022-24613

中危

个人开发者

https://cxsecurity.com/cveshow/CVE-2022-24613/

125

MetadataExtractor 安全漏洞

CNNVD-202202-1858

CVE-2022-24614

中危

个人开发者

https://cxsecurity.com/cveshow/CVE-2022-24614/

126

Apache Portable Runtime 输入验证错误漏洞

CNNVD-202301-2414

CVE-2022-25147

中危

Apache基金会

https://lists.apache.org/thread/np5gjqlohc4f62lr09vrn61vl44cylh8

127

jQuery 跨站脚本漏洞

CNNVD-202207-2121

CVE-2022-31160

中危

个人开发者

https://github.com/jquery/jquery-ui/security/advisories/GHSA-h6gj-6jjq-h8g9

128

jsoup 跨站脚本漏洞

CNNVD-202208-4329

CVE-2022-36033

中危

个人开发者

https://github.com/jhy/jsoup/security/advisories/GHSA-gp7f-rwcx-9369

129

Matthäus G. Chajdas pygments 代码问题漏洞

CNNVD-202307-1683

CVE-2022-40896

中危

Matthäus G. Chajdas

https://pypi.org/project/Pygments/

130

OpenSSL 信任管理问题漏洞

CNNVD-202303-2432

CVE-2023-0465

中危

OpenSSL

https://www.openssl.org/news/secadv/20230328.txt

131

OpenSSL 信任管理问题漏洞

CNNVD-202303-2431

CVE-2023-0466

中危

OpenSSL

https://www.openssl.org/news/secadv/20230328.txt

132

Red Hat AMQ 安全漏洞

CNNVD-202302-1203

CVE-2023-0833

中危

Red Hat

https://www.redhat.com/en/resources/amq-streams-datasheet

133

OpenSSL 缓冲区错误漏洞

CNNVD-202304-1714

CVE-2023-1255

中危

OpenSSL

https://www.openssl.org/news/vulnerabilities.html#CVE-2023-1255

134

Spring Framework 安全漏洞

CNNVD-202303-1917

CVE-2023-20861

中危

Spring

https://spring.io/security/cve-2023-20861

135

Spring Framework 安全漏洞

CNNVD-202304-1667

CVE-2023-20862

中危

Spring

https://spring.io/security/cve-2023-20862

136

Spring Framework 安全漏洞

CNNVD-202304-1094

CVE-2023-20863

中危

Spring

https://spring.io/security/cve-2023-20863

137

libssh 授权问题漏洞

CNNVD-202305-2087

CVE-2023-2283

中危

libssh

https://www.debian.org/security/2023/

138

OpenSSL 安全漏洞

CNNVD-202305-2503

CVE-2023-2650

中危

OpenSSL

https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db779b0e10b047f2585615e0b8f2acdf21f8544a

139

Intel oneAPI Toolkits 安全漏洞

CNNVD-202308-1047

CVE-2023-27391

中危

Intel

http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00890.html

140

Apache Tomcat 安全漏洞

CNNVD-202303-1662

CVE-2023-28708

中危

Apache基金会

https://lists.apache.org/thread/hdksc59z3s7tm39x0pp33mtwdrt8qr67

141

Flexera InstallShield 安全漏洞

CNNVD-202401-2402

CVE-2023-29081

中危

Flexera

https://community.flexera.com/t5/Product-Downloads/ct-p/Downloads

142

OpenSSL 授权问题漏洞

CNNVD-202307-1295

CVE-2023-2975

中危

OpenSSL团队

https://www.openssl.org/news/secadv/20230714.txt

143

glib2 资源管理错误漏洞

CNNVD-202306-1171

CVE-2023-32611

中危

GNOME

https://gitlab.gnome.org/GNOME/glib/

144

glib2 代码问题漏洞

CNNVD-202306-1168

CVE-2023-32665

中危

GNOME

https://gitlab.gnome.org/GNOME/glib/

145

Bouncy Castle 信任管理问题漏洞

CNNVD-202307-168

CVE-2023-33201

中危

Bouncy Castle

https://github.com/bcgit/bc-java/commit/e8c409a8389c815ea3fda5e8b94c92fdfe583bcc

146

Bouncy Castle 资源管理错误漏洞

CNNVD-202311-1981

CVE-2023-33202

中危

Bouncy Castle

https://www.bouncycastle.org/latest_releases.html

147

Spring Security 安全漏洞

CNNVD-202307-1539

CVE-2023-34035

中危

Spring

https://spring.io/security/cve-2023-34035

148

VMware Spring Boot 安全漏洞

CNNVD-202311-2124

CVE-2023-34055

中危

VMware

https://github.com/spring-projects/spring-boot/releases/tag/v3.0.

149

OpenSSL 安全漏洞

CNNVD-202307-1681

CVE-2023-3446

中危

OpenSSL团队

https://www.openssl.org/news/secadv/20230719.txt

150

FasterXML jackson-databind 代码问题漏洞

CNNVD-202306-1121

CVE-2023-35116

中危

FasterXML

https://github.com/FasterXML/jackson-databind/issues/3972

151

Apache MINA 路径遍历漏洞

CNNVD-202307-582

CVE-2023-35887

中危

Apache基金会

https://lists.apache.org/thread/b9qgtqvhnvgfpn0w1gz918p21p53tqk2

152

Eclipse Jetty 安全漏洞

CNNVD-202309-1093

CVE-2023-36479

中危

Eclipse基金会

https://github.com/eclipse/jetty.project/security/advisories/GHSA-3gh6-v5v9-6v9j

153

OpenSSL 安全漏洞

CNNVD-202307-2314

CVE-2023-3817

中危

OpenSSL团队

https://www.openssl.org/news/secadv/20230731.txt

154

Jenkins 跨站脚本漏洞

CNNVD-202307-2099

CVE-2023-39151

中危

Jenkins

https://www.jenkins.io/security/advisory/2023-07-26/#SECURITY-3188

155

procps 缓冲区错误漏洞

CNNVD-202308-085

CVE-2023-4016

中危

procps-ng

https://gitlab.com/procps-ng/procps

156

Eclipse Jetty 安全漏洞

CNNVD-202309-1102

CVE-2023-40167

中危

Eclipse基金会

https://github.com/eclipse/jetty.project/security/advisories/GHSA-hmr7-m48g-48f6

157

Python 安全漏洞

CNNVD-202308-2059

CVE-2023-40217

中危

Python基金会

https://www.python.org/dev/security/

158

Apache Tomcat 输入验证错误漏洞

CNNVD-202308-2096

CVE-2023-41080

中危

Apache基金会

https://lists.apache.org/thread/71wvwprtx2j2m54fovq9zr7gbm2wow2f

159

Eclipse Jetty 安全漏洞

CNNVD-202309-1113

CVE-2023-41900

中危

Eclipse基金会

https://github.com/eclipse/jetty.project/security/advisories/GHSA-pwh8-58vv-vw48

160

Apache Commons Compress 资源管理错误漏洞

CNNVD-202309-1000

CVE-2023-42503

中危

Apache基金会

https://lists.apache.org/thread/5xwcyr600mn074vgxq92tjssrchmc93c

161

Jenkins 安全漏洞

CNNVD-202309-1974

CVE-2023-43494

中危

Jenkins

https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3261

162

Jenkins 跨站脚本漏洞

CNNVD-202309-1973

CVE-2023-43495

中危

Jenkins

https://www.jenkins.io/security/advisory/2023-09-20/#SECURITY-3245

163

Apache Santuario 日志信息泄露漏洞

CNNVD-202310-1720

CVE-2023-44483

中危

Apache基金会

https://lists.apache.org/thread/vmqbp9mfxtrf0kmbnnmbn3h9j6dr9q55

164

glibc 缓冲区错误漏洞

CNNVD-202309-933

CVE-2023-4527

中危

个人开发者

https://sourceware.org/bugzilla/show_bug.cgi?id=30842

165

Apache HTTP Server 资源管理错误漏洞

CNNVD-202310-1636

CVE-2023-45802

中危

Apache基金会

https://httpd.apache.org/security/vulnerabilities_24.html

166

urllib3 信息泄露漏洞

CNNVD-202310-1359

CVE-2023-45803

中危

urllib3

https://github.com/urllib3/urllib3/security/advisories/GHSA-g4mx-q9vg-27p4

167

curl 安全漏洞

CNNVD-202312-490

CVE-2023-46218

中危

curl

https://curl.se/docs/CVE-2023-46218.html

168

curl 安全漏洞

CNNVD-202312-499

CVE-2023-46219

中危

curl

https://curl.se/docs/CVE-2023-46219.html

169

Node.js 安全漏洞

CNNVD-202402-1465

CVE-2023-46809

中危

Node.js

https://nodejs.org/

170

glibc 资源管理错误漏洞

CNNVD-202309-932

CVE-2023-4806

中危

GNU社区

https://sourceware.org/bugzilla/show_bug.cgi?id=30843

171

OpenSSH 安全漏洞

CNNVD-202312-1668

CVE-2023-48795

中危

OpenBSD

https://www.openssh.com/openbsd.html

172

Python cryptography 代码问题漏洞

CNNVD-202311-2230

CVE-2023-49083

中危

Python基金会

https://github.com/pyca/cryptography/security/advisories/GHSA-jfhm-5ghh-2f97

173

python-cryptography 安全漏洞

CNNVD-202312-1318

CVE-2023-50782

中危

Cryptographic团队

https://cryptography.io/en/latest/

174

Jayway JsonPath 安全漏洞

CNNVD-202312-2349

CVE-2023-51074

中危

json-path

https://github.com/json-path/JsonPath/issues/973

175

ImageMagick 资源管理错误漏洞

CNNVD-202310-092

CVE-2023-5341

中危

ImageMagick

https://github.com/ImageMagick/ImageMagick/commit/aa673b2e4defc7cad5bec16c4fc8324f71e531f1

176

OpenSSL 代码问题漏洞

CNNVD-202311-423

CVE-2023-5678

中危

OpenSSL

https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db925ae2e65d0d925adef429afc37f75bd1c2017

177

OpenSSL 安全漏洞

CNNVD-202401-736

CVE-2023-6129

中危

OpenSSL

https://www.openssl.org/news/secadv/20240109.txt

178

Python 安全漏洞

CNNVD-202312-708

CVE-2023-6507

中危

Python基金会

https://mail.python.org/archives/list/security-announce@python.org/thread/AUL7QFHBLILGISS7U63B47AYSSGJJQZD/

179

glibc 缓冲区错误漏洞

CNNVD-202401-2631

CVE-2023-6780

中危

个人开发者

https://github.com/kraj/glibc/releases/tag/glibc-2.38

180

curl 安全漏洞

CNNVD-202401-2732

CVE-2024-0853

中危

curl

https://curl.se/docs/CVE-2024-0853.html

181

Red Hat Undertow 安全漏洞

CNNVD-202402-940

CVE-2024-1459

中危

Red Hat

https://undertow.io/downloads.html

182

Jinja 跨站脚本漏洞

CNNVD-202401-963

CVE-2024-22195

中危

个人开发者

https://github.com/pallets/jinja/releases/tag/3.1.3

183

OWASP AntiSamy 跨站脚本漏洞

CNNVD-202402-204

CVE-2024-23635

中危

OWASP

https://github.com/nahsra/antisamy/releases/tag/v1.7.5

184

CKEditor 跨站脚本漏洞

CNNVD-202402-598

CVE-2024-24815

中危

CKEditor

https://github.com/ckeditor/ckeditor4/commit/8ed1a3c93d0ae5f49f4ecff5738ab8a2972194cb

185

CKEditor 跨站脚本漏洞

CNNVD-202402-605

CVE-2024-24816

中危

CKEditor

https://github.com/ckeditor/ckeditor4/commit/8ed1a3c93d0ae5f49f4ecff5738ab8a2972194cb

186

Apache Commons Compress 安全漏洞

CNNVD-202402-1528

CVE-2024-25710

中危

Apache

https://lists.apache.org/thread/cz8qkcwphy4cx8gltn932ln51cbtq6kf

187

Apache Commons Compress 安全漏洞

CNNVD-202402-1527

CVE-2024-26308

中危

Apache

https://lists.apache.org/thread/ch5yo2d21p7vlqrhll9b17otbyq4npfg

188

Google Guava 访问控制错误漏洞

CNNVD-202012-827

CVE-2020-8908

低危

Google

https://github.com/google/guava/issues/4011

189

curl 安全漏洞

CNNVD-202310-916

CVE-2023-38546

低危

curl

https://github.com/curl/curl/releases

190

Pip 命令注入漏洞

CNNVD-202310-1912

CVE-2023-5752

低危

Python Packaging Authority

https://github.com/pypa/pip/releases/tag/23.3.1

191

libssh 安全漏洞

CNNVD-202312-1736

CVE-2023-6004

低危

libssh

https://www.libssh.org/files/0.10/

192

libssh 安全漏洞

CNNVD-202312-1734

CVE-2023-6918

低危

libssh

https://www.libssh.org/2023/12/18/libssh-0-10-6-and-libssh-0-9-8-security-releases/

193

OpenSSL 安全漏洞

CNNVD-202401-2353

CVE-2024-0727

低危

OpenSSL

https://github.com/openssl/openssl/commit/09df4395b5071217b76dc7d3d2e630eb8c5a79c2

三、修复建议

目前,Oracle官方已经发布补丁修复了上述漏洞,建议用户及时确认漏洞影响,尽快采取修补措施。Oracle官方补丁下载地址:

https://www.oracle.com/security-alerts/cpuapr2024.html

CNNVD将继续跟踪上述漏洞的相关情况,及时发布相关信息。如有需要,可与CNNVD联系。联系方式: cnnvdvul@itsec.gov.cn

声明:本文来自CNNVD安全动态,版权归作者所有。文章内容仅代表作者独立观点,不代表安全内参立场,转载目的在于传递更多信息。如有侵权,请联系 anquanneican@163.com。