PT-2022-4640 · Oracle · Oracle Coherence

Thiscodecc · Published 2022-07-19 · Updated 2022-07-26 · CVE-2022-21570

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Oracle Coherence versions 3.7.1.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0

Description The issue is related to insufficient input validation in the Core component of Oracle Coherence, allowing an unauthenticated attacker with network access via T3 or IIOP protocols to compromise Oracle Coherence. Successful attacks can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Coherence.

Recommendations For versions 3.7.1.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0, consider restricting network access via T3 and IIOP protocols to minimize the risk of exploitation. As a temporary workaround, limit the ability of remote attackers to cause a hang or crash of Oracle Coherence by implementing additional security measures, such as network segmentation or intrusion detection systems. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Resource Release

RCE

Weakness Enumeration

CWE-404

CWE-20

Related Identifiers

BDU:2022-05524

CVE-2022-21570

Affected Products

Oracle Coherence

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-21570 · Security Note
• https://oracle.com/security-alerts/cpujul2022.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05524 · Security Note
• https://osv.dev/vulnerability/CVE-2022-21570 · Vendor Advisory
• https://t.me/cibsecurity/46618 · Telegram Post
• https://t.me/cvenotify/33792 · Telegram Post