Oracle Critical Patch Update de abril 2024 corrige 441 fallas de seguridad

18 Abril 2024

Crítico

Amenaza

En el aviso de actualización de parches críticos de Oracle de abril 2024 se reportaron 441 correcciones para fallas de seguridad, de las cuales 35 son de severidad Crítica, 189 de severidad Alta, 197 de severidad Media y finalmente 20 de severidad Baja.

Nota de Oracle:

Oracle sigue recibiendo periódicamente informes de intentos de explotar vulnerabilidades de forma malintencionada para las que Oracle ya ha publicado parches de seguridad. En algunos casos, se informó que los atacantes tuvieron éxito porque los clientes objetivo no aplicaron los parches de Oracle disponibles. Por lo tanto, Oracle recomienda encarecidamente que los clientes permanezcan en las versiones con soporte activo y apliquen los parches de seguridad Critical Patch Update sin demora.

Las vulnerabilidades de seguridad mostradas en esta actualización de parche crítico y los productos afectados que en ella se describen, se encuentran enumerados y descritos en la documentación del mes de abril 2024 de avisos de actualización de parches críticos que anexamos en el siguiente Link:

https://www.oracle.com/security-alerts/cpuapr2024.html

Mitigación

Instalar las actualizaciones del fabricante disponibles en medios oficiales del proveedor, previo análisis del impacto que podría provocar en los servicios críticos para el negocio de su organización. Para ello consulte con su personal técnico o áreas resolutorias correspondientes.
Oracle recomienda encarecidamente que los clientes apliquen los parches de seguridad disponibles lo antes posible. Para los clientes que se han saltado una o más actualizaciones de parches críticos y están preocupados por los productos que no tienen parches de seguridad anunciados en esta actualización de parches críticos, revise los avisos de actualizaciones de parches críticos anteriores para determinar las acciones apropiadas.
Debido a la amenaza que representa un ataque exitoso, Oracle recomienda encarecidamente que los clientes apliquen los parches de seguridad críticos (actualización) lo antes posible.

El listado de las CVE se adjunta a continuación:

Listado CVE

CVE-2023-48795
CVE-2024-21093
CVE-2024-21058
CVE-2023-5072
CVE-2024-21066
CVE-2023-36632
CVE-2024-20995
CVE-2023-46589
CVE-2023-5072
CVE-2022-46364
CVE-2023-1370
CVE-2022-42003
CVE-2023-2976
CVE-2023-20863
CVE-2023-41080
CVE-2024-21100
CVE-2023-47100
CVE-2022-34381
CVE-2023-44487
CVE-2023-34053
CVE-2024-21634
CVE-2023-4043
CVE-2023-6378
CVE-2022-34169
CVE-2021-37533
CVE-2023-34055
CVE-2023-0833
CVE-2024-26308
CVE-2023-43496
CVE-2023-4863
CVE-2024-21626
CVE-2024-22257
CVE-2024-22259
CVE-2023-41056
CVE-2023-51257
CVE-2024-26130
CVE-2024-22201
CVE-2022-40152
CVE-2023-49083
CVE-2024-22233
CVE-2023-45142
CVE-2024-25062
CVE-2023-5363
CVE-2024-1635
CVE-2022-45688
CVE-2023-51775
CVE-2023-31122
CVE-2023-46589
CVE-2023-2283
CVE-2023-4641
CVE-2022-40896
CVE-2023-5341
CVE-2023-51074
CVE-2023-33201
CVE-2023-6507
CVE-2023-4016
CVE-2024-21095
CVE-2023-52428
CVE-2023-50386
CVE-2024-22243
CVE-2024-21071
CVE-2024-21078
CVE-2024-21079
CVE-2024-21088
CVE-2024-21073
CVE-2024-21075
CVE-2024-21074
CVE-2024-21077
CVE-2024-21076
CVE-2024-21080
CVE-2024-21089
CVE-2024-21016
CVE-2024-21017
CVE-2024-21018
CVE-2024-21019
CVE-2024-21020
CVE-2024-21021
CVE-2024-21022
CVE-2024-21023
CVE-2024-21024
CVE-2024-21025
CVE-2024-21026
CVE-2024-21027
CVE-2024-21028
CVE-2024-21029
CVE-2024-21030
CVE-2024-21031
CVE-2024-21032
CVE-2024-21033
CVE-2024-21034
CVE-2024-21035
CVE-2024-21036
CVE-2024-21037
CVE-2024-21038
CVE-2024-21039
CVE-2024-21040
CVE-2024-21041
CVE-2024-21042
CVE-2024-21043
CVE-2024-21044
CVE-2024-21045
CVE-2024-21046
CVE-2024-21072
CVE-2024-20990
CVE-2024-21081
CVE-2024-21086
CVE-2024-21048
CVE-2022-42920
CVE-2022-46337
CVE-2024-21067
CVE-2021-36770
CVE-2023-20861
CVE-2023-42503
CVE-2023-46604
CVE-2022-46337
CVE-2023-44981
CVE-2023-2618
CVE-2023-44271
CVE-2023-44483
CVE-2024-23635
CVE-2022-31160
CVE-2024-20997
CVE-2024-21010
CVE-2024-21014
CVE-2024-20989
CVE-2024-1597
CVE-2019-13990
CVE-2022-1471
CVE-2022-45378
CVE-2021-23369
CVE-2023-37536
CVE-2019-0231
CVE-2023-24021
CVE-2019-10172
CVE-2023-3635
CVE-2024-21006
CVE-2024-21007
CVE-2022-25147
CVE-2023-46218
CVE-2022-34169
CVE-2022-48579
CVE-2022-24329
CVE-2024-20991
CVE-2024-21119
CVE-2024-21117
CVE-2024-21120
CVE-2024-21118
CVE-2023-35116
CVE-2024-20992
CVE-2023-35887
CVE-2024-21082
CVE-2023-43804
CVE-2022-42890
CVE-2021-28861
CVE-2024-21083
CVE-2024-21084
CVE-2024-21064
CVE-2024-21001
CVE-2023-3817
CVE-2024-21099
CVE-2023-5072
CVE-2023-42503
CVE-2022-42889
CVE-2023-6246
CVE-2023-29081
CVE-2021-43113
CVE-2021-41616
CVE-2022-41853
CVE-2024-24816
CVE-2023-37536
CVE-2024-21892
CVE-2023-41993
CVE-2024-20954
CVE-2024-21098
CVE-2024-21085
CVE-2024-21011
CVE-2024-21068
CVE-2024-21094
CVE-2024-21012
CVE-2024-21003
CVE-2024-21005
CVE-2024-21002
CVE-2024-21004
CVE-2024-21090
CVE-2023-6129
CVE-2024-21015
CVE-2024-0853
CVE-2024-20994
CVE-2024-21102
CVE-2024-21047
CVE-2024-21061
CVE-2024-21069
CVE-2024-21049
CVE-2024-21050
CVE-2024-21051
CVE-2024-21052
CVE-2024-21053
CVE-2024-21056
CVE-2024-21060
CVE-2024-21087
CVE-2024-20993
CVE-2024-20998
CVE-2024-21009
CVE-2024-21054
CVE-2024-21055
CVE-2024-21057
CVE-2024-21062
CVE-2024-21096
CVE-2024-21008
CVE-2024-21013
CVE-2024-21000
CVE-2024-21101
CVE-2023-38545
CVE-2023-4807
CVE-2024-21063
CVE-2024-21065
CVE-2022-24613
CVE-2024-21070
CVE-2024-21097
CVE-2023-1436
CVE-2023-34981
CVE-2024-21092
CVE-2023-24998
CVE-2024-21091
CVE-2020-35168
CVE-2024-20999
CVE-2024-21059
CVE-2022-24839
CVE-2024-21104
CVE-2022-36033
CVE-2021-36374
CVE-2023-1370
CVE-2024-21105
CVE-2020-25638
CVE-2023-44487
CVE-2024-21112
CVE-2024-21113
CVE-2024-21114
CVE-2024-21115
CVE-2024-21103
CVE-2024-21111
CVE-2024-21116
CVE-2024-21110
CVE-2024-21107
CVE-2024-21106
CVE-2024-21121
CVE-2024-21109
CVE-2024-21108

Tags: #Vulnerabilidad #Oracle #Parche #PatchDay

Fuentes utilizadas

https://www.oracle.com/security-alerts/cpu...

Productos Afectados

Producto	Versión
Grid Infrastructure (Apache Mina SSHD)	21.3-21.13
Oracle SQLcl (Apache Mina SSHD)	19.3-19.22 21.3-21.13
Java VM	19.3-19.22 21.3-21.13
Unified Audit	19.3-19.22 21.3-21.13
GraalVM Multilingual Engine	21.3-21.13
RDBMS	19.3-19.22 21.3-21.13
RDBMS (Python)	21.3-21.13
Oracle Database Sharding	19.3-19.22 21.3-21.13
Autonomous Health Framework	antes de 24.2
Oracle Big Data Spatial and Graph	3.0.5
OPatchAuto	antes de 12.2.0.1.42
Oracle GoldenGate Stream Analytics	19.1.0.0.0-19.1.0.0.8
Oracle Commerce Platform	11.3.0 11.3.1 11.3.2
Oracle Commerce Guided Search	11.3.2
Oracle Communications Billing and Revenue Management	12.0.0.4-12.0.0.8 15.0.0.0
Oracle Communications Network Integrity	7.3.6.4
Oracle Communications Unified Inventory Management	7.4.1 7.4.2
Oracle Communications BRM - Elastic Charging Engine	12.0.0.4-12.0.0.8 15.0.0.0
Oracle Communications Service Catalog and Design	8.0.0.1.0
Oracle Communications Offline Mediation Controller	12.0.0.1-12.0.0.8
Oracle Communications Cloud Native Core Network Repository Function	23.4.1
Oracle Communications Cloud Native Core Network Slice Selection Function	23.2.0 23.3.0
Oracle Communications Diameter Signaling Router	9.0.0.0
Oracle Communications Cloud Native Core Network Function Cloud Native Environment	23.2.0 23.3.1 23.4.0
Oracle Communications Cloud Native Core Binding Support Function	23.4.0-23.4.2
Oracle Communications Cloud Native Core Console	23.4.0
Oracle Communications Cloud Native Core Policy	23.4.0-23.4.2
Oracle Communications Cloud Native Core Network Data Analytics Function	24.1.0
Oracle Communications Operations Monitor	5.1 5.2
Oracle Communications Cloud Native Core Unified Data Repository	22.4.0 23.1.0 23.2.0 23.3.2
Management Cloud Engine	24.1.0.0.0
Oracle Communications Cloud Native Core Network Exposure Function	23.4.1
Oracle Communications Cloud Native Core Security Edge Protection Proxy	23.4.0
Oracle Communications Cloud Native Core Service Communication Proxy	23.2.2
Oracle Communications Element Manager	9.0.0-9.0.2
Oracle Communications Fraud Monitor	5.0 5.1 5.2
Oracle Communications Session Report Manager	9.0.0-9.0.2
Oracle Communications User Data Repository	14.0.0.0.0
Oracle Communications WebRTC Session Controller	7.2.0.0.0-7.2.1.0.0
Oracle SD-WAN Edge	9.1.1.7.0
Primavera P6 Enterprise Project Portfolio Management	19.12.0-19.12.22 20.12.0-20.12.21 21.12.0-21.12.18 22.12.0-22.12.12 23.12.0-23.12.2
Primavera Gateway	19.12.0-19.12.18 20.12.0-20.12.13 21.12.0-21.12.11
Primavera Unifier	22.12.0-22.12.12 23.12.0-23.12.3
Oracle Workflow	12.2.3-12.2.13
Oracle Marketing	12.2.3-12.2.13
Oracle Production Scheduling	12.2.4-12.2.12
Oracle Trade Management	12.2.3-12.2.13
Oracle Applications Framework	12.2.9-12.2.13
Oracle Concurrent Processing	12.2.3-12.2.13
Oracle Complex Maintenance, Repair, and Overhaul	12.2.3-12.2.13
Oracle Installed Base	12.2.3-12.2.13
Oracle Applications Technology	12.2.3-12.2.13
Oracle Partner Management	12.2.3-12.2.13
Oracle CRM Technical Foundation	12.2.3-12.2.13
Oracle Web Applications Desktop Integrator	12.2.3-12.2.13
Oracle Application Testing Suite	13.3.0.1
Oracle Enterprise Manager for Fusion Middleware	13.5.0.0
Oracle Enterprise Manager Base Platform	13.5.0.0
Oracle FLEXCUBE Private Banking	12.1.0.0.0
Oracle Banking Branch	14.5.0.0.0 14.6.0.0.0 14.7.0.0.0
Oracle Banking Cash Management	14.5.0.0.0 14.6.0.0.0 14.7.0.0.0
Oracle Banking Liquidity Management	14.7.0.3.0
Oracle Banking Origination	14.5.0.0.0 14.6.0.0.0 14.7.0.0.0
Oracle Banking Virtual Account Management	14.5.0.0.0 14.6.0.0.0 14.7.0.0.0
Oracle Banking Deposits and Lines of Credit Servicing	2.12.0.0.0
Oracle Banking Enterprise Default Management	2.7.0.0.0 2.12.0.0.0
Oracle Banking Loans Servicing	2.12.0.0.0
Oracle Banking Party Management	2.7.0.0.0
Oracle Banking Platform	2.7.0.0.0
Oracle Financial Services Revenue Management and Billing	2.8.0.0.0 2.9.0.0.0 2.9.0.1.0 3.0.0.0.0 3.1.0.0.0 3.2.0.0.0 4.0.0.0 5.0.0.0
Oracle Banking APIs	19.1.0.0.0 19.2.0.0.0 21.1.0.0.0 22.1.0.0.0 22.2.0.0.0
Oracle Banking Digital Experience	19.1.0.0.0 19.2.0.0.0 21.1.0.0.0 22.1.0.0.0 22.2.0.0.0
Oracle Hospitality Simphony	19.1.0-19.5.4
Oracle Enterprise Data Quality	12.2.1.4.0
Oracle Fusion Middleware MapViewer	12.2.1.4.0
Oracle HTTP Server	12.2.1.4.0
Oracle Identity Manager	12.2.1.4.0
Oracle Internet Directory	12.2.1.4.0
Oracle Middleware Common Libraries and Tools	12.2.1.4.0 14.1.1.0.0
Oracle SOA Suite	12.2.1.4.0
Oracle Web Services Manager	12.2.1.4.0
Oracle WebLogic Server	14.1.1.0.0
Oracle Access Manager	12.2.1.4.0
Oracle Data Integrator	12.2.1.4.0
Oracle Identity Manager Connector	12.2.1.3.0
Oracle Managed File Transfer	12.2.1.4.0
Oracle WebCenter Content	12.2.1.4.0
Oracle WebCenter Enterprise Capture	12.2.1.4.0
Oracle Outside In Technology	8.5.6 8.5.7
Oracle Coherence	12.2.1.4.0 14.1.1.0.0
Oracle Global Lifecycle Management NextGen OUI Framework	12.2.1.4.0
Oracle WebCenter Portal	12.2.1.4.0
Oracle BI Publisher	7.0.0.0.0 12.2.1.4.0
Oracle Business Intelligence Enterprise Edition	7.0.0.0.0 12.2.1.4.0
Oracle Life Sciences Empirica Signal	9.1.0.53 9.2.0.53
Oracle Healthcare Data Repository	8.1.0.0 8.1.1.0 8.1.2.0 8.1.3.0 8.1.3.2 8.1.3.4
Oracle Hospitality Cruise Shipboard Property Management System	20.3.3 20.3.4 23.1.0 23.1.1
Oracle Hyperion Infrastructure Technology	11.2.16.0.000
Oracle Smart View for Office	11.2.16.0.000
Oracle Documaker	12.6 12.7
Oracle GraalVM for JDK	Oracle GraalVM for JDK: 17.0.10 21.0.2 22
Oracle Java SE, Oracle GraalVM Enterprise Edition	Oracle Java SE: 8u401 8u401-perf 11.0.22
Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition	Oracle GraalVM for JDK: 17.0.10 21.0.2 22
Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition	Oracle Java SE: 11.0.22 17.0.10 21.0.2 22
MySQL Cluster	7.5.33 y antes de 7.6.29 y antes de 8.0.36 y antes de 8.3.0 y antes de
MySQL Connectors	8.3.0 y antes de
MySQL Enterprise Backup	8.0.36 y antes de 8.3.0 y antes de
MySQL Enterprise Monitor	8.0.37 y antes de
MySQL Server	8.0.35 y antes de
PeopleSoft Enterprise PeopleTools	8.61
PeopleSoft Enterprise CRM Client Management	9.2
PeopleSoft Enterprise HCM Benefits Administration	9.2
Oracle Retail Assortment Planning	15.0.3 16.0.3
Oracle Retail Integration Bus	14.1.3.2 15.0.3.1 16.0.3 19.0.1
Oracle Retail Service Backbone	14.1.3.2 15.0.3.1 16.0.3 19.0.1
Oracle Retail Merchandising System	14.1.3 15.0.3 16.0.3 19.0.1
Oracle Retail Sales Audit	14.1.3.1 15.0.3.1 16.0.3 19.0.1
Oracle Retail Xstore Point of Service	19.0.5 20.0.4 21.0.3 22.0.1 23.0.1
Oracle Retail Customer Management and Segmentation Foundation	19.0.0.9
Siebel Apps - Public Sector	24.2 y antes de
Oracle Agile Product Lifecycle Management for Process	6.2.4.2
Oracle Agile PLM	9.3.6
Oracle Transportation Management	6.5.2 6.5.3
OSS Support Tools	24.1.24.1.16
Oracle Solaris Cluster	4
Oracle StorageTek Tape Analytics (STA)	2.5
Oracle Solaris	11
Oracle ZFS Storage Appliance Kit	8.8
Oracle Utilities Application Framework	4.3.0.3.0-4.3.0.6.0 4.4.0.0.0 4.4.0.2.0 4.4.0.3.0 4.5.0.0.0 4.5.0.1.1 4.5.0.1.2
Oracle Utilities Network Management System	2.5.0.1 2.5.0.2 2.6.0.0 2.6.0.1
Oracle VM VirtualBox	antes de 7.0.16