PT-2024-4992 · Oracle · Oracle Database Server+1

Published 2024-07-16 · Updated 2025-06-18 · CVE-2024-21126

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: Oracle Database Server versions 19.3 through 19.23 Oracle Database Server versions 21.3 through 21.14

Description: The issue is related to insufficient input validation in the Oracle Database Portable Clusterware component, allowing an unauthenticated attacker with network access via DNS to compromise Oracle Database Portable Clusterware. Successful attacks can result in a partial denial of service (partial DOS) of Oracle Database Portable Clusterware, potentially impacting additional products.

Recommendations: For versions 19.3 through 19.23, update to a version outside of this range to resolve the issue. For versions 21.3 through 21.14, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the Oracle Database Portable Clusterware component to minimize the risk of exploitation.

Fix

DoS

Resource Exhaustion

RCE

Weakness Enumeration

CWE-400

CWE-20

Related Identifiers

BDU:2024-05516

CVE-2024-21126

Affected Products

Oracle Database Portable Clusterware

Oracle Database Server

References · 7

• https://bdu.fstec.ru/vul/2024-05516 · Security Note
• https://osv.dev/vulnerability/CVE-2024-21126 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21126 · Security Note
• https://oracle.com/security-alerts/cpujul2024.html · Vendor Advisory
• https://t.me/cvenotify/126116 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2024071850 · Note
• https://vuldb.com/fr/?id.271789 · Note