PT-2023-24839 · Progress · Progress Datadirect Connect For Odbc

Published 2023-06-08 · Updated 2025-01-06 · CVE-2023-34363

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Progress DataDirect Connect for ODBC versions prior to 08.02.2770 for Oracle

Description An issue was discovered when using Oracle Advanced Security (OAS) encryption. If an error occurs while initializing the encryption object, the code falls back to a different encryption mechanism that uses an insecure random number generator to generate the private key. This allows a well-placed attacker to potentially predict the output of the random number generator, leading to the decryption of traffic between the driver and the database server. The issue does not exist when SSL/TLS encryption is used.

Recommendations For versions prior to 08.02.2770, update to version 08.02.2770 or later to resolve the issue. As a temporary workaround, consider using SSL/TLS encryption instead of Oracle Advanced Security (OAS) encryption to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-338

Related Identifiers

CVE-2023-34363

Affected Products

Progress Datadirect Connect For Odbc

References · 8

• https://community.progress.com/s/article/Security-vulnerabilities-in-DataDirect-ODBC-Oracle-Wire-Protocol-driver-June-2023 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-34363 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-34363 · Security Note
• https://t.me/aptreports/4295 · Telegram Post
• https://t.me/cvenotify/106407 · Telegram Post
• https://t.me/cvenotify/52777 · Telegram Post
• https://t.me/cvenotify/52023 · Telegram Post
• https://progress.com · Note