Segunda Actualización de parches críticos 2021 de Oracle

21 Abril 2021

Crítico

Amenaza

La segunda actualización de parches críticos (Critical Patch Update) del año de Oracle contiene 390 nuevos parches de seguridad para distintas familias de productos. En el reporte final se obtiene un total de 263 CVE involucrados con distintas vulnerabilidades, desglosando en 32 vulnerabilidades críticas, 124 altas, 94 medias y 13 vulnerabilidades bajas.

Información referente a las actualizaciones

Cinco de las vulnerabilidades críticas reportadas tienen una puntuación CVSS de 10, Las más graves de estas vulnerabilidades podría aprovecharse para ejecutar código de forma remota dentro del contexto de las aplicaciones vulnerables, lo que podría resultar en un compromiso total del sistema.

Debido a la amenaza que representa un ataque exitoso, Oracle recomienda encarecidamente a los clientes que apliquen los parches de seguridad Critical Patch Update lo antes posible .

Para los ataques que requieren ciertos privilegios o acceso a ciertos paquetes, eliminar los privilegios o la capacidad de acceder a los paquetes de los usuarios que no necesitan los privilegios puede ayudar a reducir el riesgo de un ataque exitoso.

Próximas fechas

Los siguientes programas de actualización de parches críticos se publicarán en la fecha más cercana al día 17 de los siguientes meses:

20 de julio de 2021
19 de octubre de 2021
18 de enero de 2022

Las vulnerabilidades de seguridad mostradas en esta actualización de parche crítico y los productos afectados que en ella se describen, se encuentran enumerados y descritos en la documentación del mes de Abril de avisos de actualización de parches críticos que anexamos en el siguiente Link

Mitigación

El Centro de Ciberinteligencia de Entel CyberSecure recomienda lo siguiente:

Instalar las actualizaciones del fabricante disponibles en medios oficiales del proveedor, previo análisis del impacto que podría provocar en los servicios críticos para el negocio de su organización. Para ello consulte con su personal técnico o áreas resolutorias correspondientes.
Seguir instrucciones de Oracle con respecto a qué organizaciones prueben los cambios en los sistemas que no son de producción.

El listado de las CVE se adjunta a continuación:

Listado CVE

CVE-2021-2317
CVE-2021-2256
CVE-2020-1472
CVE-2021-2177
CVE-2021-2248
CVE-2019-17495
CVE-2020-28052
CVE-2020-11612
CVE-2019-0228
CVE-2019-0219
CVE-2019-17195
CVE-2020-11998
CVE-2020-5413
CVE-2019-3773
CVE-2020-9480
CVE-2020-10683
CVE-2021-2302
CVE-2021-2136
CVE-2021-2135
CVE-2018-1285
CVE-2020-17530
CVE-2019-2904
CVE-2021-2244
CVE-2021-2221
CVE-2019-17638
CVE-2021-2200
CVE-2021-2205
CVE-2020-1945
CVE-2021-2318
CVE-2021-2319
CVE-2021-2320
CVE-2021-2253
CVE-2020-5421
CVE-2021-22112
CVE-2019-5064
CVE-2020-26217
CVE-2020-10878
CVE-2021-2209
CVE-2021-2264
CVE-2020-10188
CVE-2021-2218
CVE-2021-2182
CVE-2021-2183
CVE-2021-2184
CVE-2021-2185
CVE-2021-2186
CVE-2021-2187
CVE-2021-2188
CVE-2021-2197
CVE-2021-2150
CVE-2021-2199
CVE-2021-2198
CVE-2021-2195
CVE-2021-2206
CVE-2021-2210
CVE-2021-2242
CVE-2021-2250
CVE-2020-24750
CVE-2021-2247
CVE-2021-2269
CVE-2021-2314
CVE-2021-2222
CVE-2021-2288
CVE-2021-2227
CVE-2021-2224
CVE-2021-2295
CVE-2021-2251
CVE-2021-2156
CVE-2021-2229
CVE-2021-2292
CVE-2021-2225
CVE-2021-2274
CVE-2021-2290
CVE-2021-2233
CVE-2021-2236
CVE-2021-2237
CVE-2021-2316
CVE-2021-2260
CVE-2021-2228
CVE-2021-2231
CVE-2021-2276
CVE-2021-2241
CVE-2021-2267
CVE-2021-2249
CVE-2021-2261
CVE-2021-2273
CVE-2021-2252
CVE-2021-2238
CVE-2021-2259
CVE-2021-2289
CVE-2021-2254
CVE-2021-2258
CVE-2021-2262
CVE-2021-2268
CVE-2021-2223
CVE-2021-2255
CVE-2021-2270
CVE-2021-2263
CVE-2021-2272
CVE-2021-2239
CVE-2021-2235
CVE-2021-2246
CVE-2021-2271
CVE-2020-28052
CVE-2020-14195
CVE-2021-2279
CVE-2021-2167
CVE-2021-2181
CVE-2020-5360
CVE-2020-17527
CVE-2020-13956
CVE-2020-11612
CVE-2021-22883
CVE-2019-12423
CVE-2020-13871
CVE-2020-11979
CVE-2020-25649
CVE-2020-1971
CVE-2020-1967
CVE-2021-2189
CVE-2021-2190
CVE-2020-11994
CVE-2019-17566
CVE-2018-20843
CVE-2021-2277
CVE-2018-1000180
CVE-2019-12402
CVE-2021-2157
CVE-2021-23841
CVE-2020-8277
CVE-2021-3449
CVE-2020-28196
CVE-2020-8286
CVE-2017-18640
CVE-2020-11987
CVE-2017-12626
CVE-2020-5398
CVE-2019-0227
CVE-2021-2309
CVE-2021-2145
CVE-2021-2310
CVE-2021-3450
CVE-2021-2219
CVE-2019-10086
CVE-2021-2008
CVE-2021-2240
CVE-2021-2144
CVE-2017-1000061
CVE-2021-2280
CVE-2021-2281
CVE-2021-2282
CVE-2021-2283
CVE-2021-2284
CVE-2021-2285
CVE-2021-2286
CVE-2021-2287
CVE-2021-2151
CVE-2019-3740
CVE-2021-2275
CVE-2021-2134
CVE-2020-5408
CVE-2021-2311
CVE-2021-2294
CVE-2021-2172
CVE-2021-2298
CVE-2021-2178
CVE-2021-2202
CVE-2019-10080
CVE-2020-8203
CVE-2019-3900
CVE-2020-11023
CVE-2020-11022
CVE-2020-27193
CVE-2020-13954
CVE-2020-1927
CVE-2017-14735
CVE-2021-2053
CVE-2021-2140
CVE-2019-0221
CVE-2021-2142
CVE-2020-9281
CVE-2021-2307
CVE-2021-2216
CVE-2016-7103
CVE-2019-11358
CVE-2021-2192
CVE-2021-2306
CVE-2021-2266
CVE-2016-5725
CVE-2021-2211
CVE-2021-2161
CVE-2020-1971
CVE-2020-17521
CVE-2020-9489
CVE-2020-27842
CVE-2021-20227
CVE-2021-2304
CVE-2021-2191
CVE-2021-2315
CVE-2021-2220
CVE-2021-2234
CVE-2020-27223
CVE-2020-13956
CVE-2020-11987
CVE-2021-2204
CVE-2021-2163
CVE-2019-7317
CVE-2021-2296
CVE-2021-2297
CVE-2021-2180
CVE-2021-2194
CVE-2021-2154
CVE-2021-2166
CVE-2021-2196
CVE-2021-2300
CVE-2021-2305
CVE-2021-2179
CVE-2021-2226
CVE-2021-2160
CVE-2021-2164
CVE-2021-2169
CVE-2021-2170
CVE-2021-2193
CVE-2021-2203
CVE-2021-2212
CVE-2021-2213
CVE-2021-2278
CVE-2021-2299
CVE-2021-2230
CVE-2021-2146
CVE-2021-2201
CVE-2021-2208
CVE-2021-2215
CVE-2021-2217
CVE-2021-2293
CVE-2021-2303
CVE-2020-27218
CVE-2021-2291
CVE-2021-2214
CVE-2021-2174
CVE-2021-2171
CVE-2021-2312
CVE-2020-7760
CVE-2021-2153
CVE-2021-2155
CVE-2021-2162
CVE-2020-1971
CVE-2021-2173
CVE-2021-2257
CVE-2021-2152
CVE-2021-2158
CVE-2020-9488
CVE-2021-2159
CVE-2020-8908
CVE-2021-2175
CVE-2021-2245
CVE-2021-2301
CVE-2021-2308
CVE-2021-2149
CVE-2021-2207
CVE-2021-2141
CVE-2021-2232
CVE-2021-2147

Tags: #Oracle #Parches #Actualización #Seguridad

Fuentes utilizadas

https://www.oracle.com/security-alerts/cpu...

Productos Afectados

Producto	Versión
Oracle Commerce Merchandising	0 11.0.0 11.1 11.2.0 11.3.0 11.3.1 11.3.2
Oracle Graph	Server y Client
Oracle API Gateway	11.1.2.4.0
Oracle Insurance Data Gateway	1.0.2.3
Oracle Retail Macro Space Optimization	16.0.3
Oracle SD-WAN Aware	8.2
Oracle Communications Contacts Server	8.0
Oracle SD-WAN Edge	8.2 9.0
Oracle Retail Regular Price Optimization	16.0.3
Primavera Unifier	16.1 16.2 17.7-17.12 18.8 19.12 20.12
Oracle WebLogic Server	10.3.6.0.0 12.1.3.0.0 12.2.1.3.0 12.2.1.4.0 14.1.1.0.0
MySQL Cluster	8.0.23 y anteriores
MySQL Workbench	8.0.23 y anteriores
Hyperion Financial Management	11.1.2.4
Oracle Retail Item Planning	16.0.3
Oracle Retail Central Office	14.1
JD Edwards World Security	A9.4
Oracle Communications Session Border Controller	Cz8.2 Cz8.3 Cz8.4
Oracle Retail Replenishment Optimization	16.0.3
Oracle Communications Unified Inventory Management	7.3.4 7.3.5 7.4.0 7.4.1
PeopleSoft Enterprise PT PeopleTools	8.56 8.57 8.58
Oracle Health Sciences Empirica Signal	9.0 9.1
Oracle Retail Advanced Inventory Planning	14.1
Oracle Service Bus	11.1.1.9.0 12.2.1.3.0 12.2.1.4.0
Oracle Banking Platform	2.4.0 2.6.2 2.7.0 2.7.1 2.8.0 2.9.0 2.10.0
Oracle Application Express	anteriores a 20.2
Oracle Retail Merchandising System	16.0.3
Oracle Enterprise Communications Broker	PCZ3.1 PCZ3.2 PCZ3.3
Enterprise Manager Base Platform	13.4.0.0
Oracle Secure	Backup
Oracle Retail Assortment Planning	16.0.3
Oracle Communications Services Gatekeeper	6.0 6.1 7.0
Oracle Platform Security for Java	11.1.1.9.0 12.2.1.3.0 12.2.1.4.0
PeopleSoft Enterprise SCM Purchasing	9.2
Oracle Retail Predictive Application Server	14.1 15.0 16.0
Oracle VM VirtualBox	anterior a 6.1.20
Oracle Communications Calendar Server	8.0
Oracle Communications MetaSolv Solution	6.3.0 6.3.1
PeopleSoft Enterprise FIN Common Application Objects	9.2
Oracle Hospitality Inventory Management	9.1.0
Oracle Retail Merchandise Financial Planning	16.0.3
Oracle Business Intelligence Enterprise Edition	5.5.0.0.0 11.1.1.9.0 12.2.1.3.0 12.2.1.4.0
Oracle NoSQL Database	anterior a 20.3
OSS Support Tools	anterior a 2.12.41
Oracle BAM (Business Activity Monitoring)	11.1.1.9.0 12.2.1.3.0 12.2.1.4.0
Oracle Utilities Framework	4.2.0.2.0 4.2.0.3.0 4.3.0.1.0-4.3.0.6.0 4.4.0.0.0 4.4.0.2.0 4.4.0.3.0
Oracle Commerce Guided Search	11.3.0 11.3.1 11.3.2
Oracle TimesTen In-Memory	Database
Oracle Communications Unified Session Manager	SCz8.2.5
Instantis EnterpriseTrack	17.1 17.2 17.3
Oracle Solaris	10 11
Oracle Retail Insights Cloud Service Suite	19.0
Agile Product Lifecycle Management Integration Pack for SAP Design to Release	3.5 3.6
Oracle Fusion Middleware	11.1.1.9.0 12.2.1.3.0 12.2.1.4.0
Oracle Financial Services Analytical Applications Infrastructure	8.0.6-8.1.0
Oracle Security Service	11.1.1.9.0 12.2.1.3.0 12.2.1.4.0
Oracle E-Business Suite	12.1.1-12.1.3 12.2.3-12.2.10
Agile Product Lifecycle Management Integration Pack for Oracle E-Business Suite	3.5 3.6
Oracle Communications Session Router	Cz8.2 Cz8.3 Cz8.4
Oracle Retail Size Profile Optimization	16.0.3
Siebel Applications	21.2 y anteriores
Oracle Outside In Technology	8.5.5
Oracle HTTP Server	11.1.1.9.0 12.2.1.3.0 12.2.1.4.0
Oracle FLEXCUBE Private Banking	12.0.0 12.1.0
Oracle Agile PLM	9.3.3 9.3.5 9.3.6
Oracle Retail Sales Audit	14.0
Oracle Global Lifecycle Management OPatch	anteriores a 12.2.0.1.22
Oracle Retail Category Management Planning & Optimization	16.0.3
Oracle ZFS Storage Appliance Kit	8.8
MySQL Enterprise Monitor	8.0.23 y anteriores
Hyperion Analytic Provider Services	11.1.2.4 12.2.1.4
Oracle Retail Returns Management	14.1
Oracle Communications Design Studio	7.4.2
MySQL Server	5.7.33 y anteriores 8.0.23 y anteriores
Oracle Communications Subscriber-Aware Load Balancer	Cz8.2 Cz8.3 Cz8.4
Oracle Application Testing Suite	13.3.0.1
Oracle Communications Converged Application Server - Service Controller	6.2
Primavera Gateway	17.12.0-17.12.10
PeopleSoft Enterprise PeopleTools	8.56 8.57 8.58
Oracle Cloud Infrastructure Storage Gateway	anteriores a 1.4
Oracle Retail Point-of-Service	14.1
Oracle Database Server	12.1.0.2 12.2.0.1 18c 19c
Oracle Endeca Information Discovery Studio	3.2.0.0
Oracle Communications Performance Intelligence Center Software	10.4.0.2 10.4.0.3
Oracle Storage Cloud Software Appliance	anterior a 16.3.1.4.2
Oracle Hospitality Cruise Shipboard Property Management System	20.1.0
PeopleSoft Enterprise SCM eProcurement	9.2
Enterprise Manager Ops Center	12.4.0.0
Oracle Identity Manager Connector	11.1.1.5.0
Oracle Rapid Planning	12.1.3
Oracle Java SE	7u291 8u281 11.0.10 16
Oracle FLEXCUBE Direct Banking	12.0.2 12.0.3
JD Edwards EnterpriseOne Tools	anteriores a 9.2.4.0 anteriores a 9.2.5.3
Oracle Hospitality RES 3700	5.7.0-5.7.6
Oracle GraalVM Enterprise Edition	19.3.5 20.3.1.2 21.0.0.2
Oracle Communications Interactive Session Recorder	6.3 6.4
Oracle Communications Messaging Server	8.0.2 8.1 8.1.0
Oracle Retail Xstore Point of Service	15.0.4 16.0.6 17.0.4 18.0.3 19.0.2
Enterprise Manager for Virtualization	13.4.0.0
Oracle WebLogic Server Proxy Plug-In	11.1.1.9.0 12.2.1.3.0 12.2.1.4.0
Oracle SQL Developer	anterior a 20.4.1.407.6
PeopleSoft Enterprise FIN Expenses	9.2
Oracle Fusion Middleware MapViewer	12.2.1.4.0
JD Edwards EnterpriseOne Orchestrator	anteriores a 9.2.5.3
PeopleSoft Enterprise CS Campus Community	9.2
Oracle Healthcare Foundation	7.1.5 7.2.2 7.3.0 7.3.1 8.0.1
Oracle iLearning	6.2 6.3
Oracle Coherence	3.7.1.0 12.1.3.0.0 12.2.1.3.0 12.2.1.4.0 14.1.1.0.0
Oracle Communications Application Session Controller	3.9m0p3
Oracle Health Sciences Information Manager	3.0.0-3.0.2
Oracle Hospitality OPERA 5	5.5 5.6
Enterprise Manager for Fusion Middleware	12.2.1.4 13.4.0.0
Oracle REST Data Services	anterior a 20.4.3.50.1904
Oracle Retail Back Office	14.1
Oracle Advanced Supply Chain Planning	12.1 12.2
Oracle Enterprise Session Border Controller	Cz8.2 Cz8.3 Cz8.4
Oracle WebCenter Portal	12.2.1.3.0 12.2.1.4.0
Oracle Secure Global Desktop	5.6
Oracle Java SE Embedded	8u281
Oracle Retail EFTLink	15.0.2 16.0.3 17.0.2 18.0.1 19.0.1 20.0.0
Oracle Enterprise Repository	11.1.1.7.0
Oracle Retail Store Inventory Management	14.1.3.10 15.0.3.5 16.0.3.5
FMW Platform	12.2.1.3.0 12.2.1.4.0
Oracle Spatial Studio	anterior a 19.1.0 anterior a 20.1.1