Segunda Actualización de parches críticos 2021 de Oracle

21 Abril 2021

Crítico

Amenaza

La segunda actualización de parches críticos (Critical Patch Update) del año de Oracle contiene 390 nuevos parches de seguridad para distintas familias de productos. En el reporte final se obtiene un total de 263 CVE involucrados con distintas vulnerabilidades, desglosando en 32 vulnerabilidades críticas, 124 altas, 94 medias y 13 vulnerabilidades bajas.

Información referente a las actualizaciones

Cinco de las vulnerabilidades críticas reportadas tienen una puntuación CVSS de 10, Las más graves de estas vulnerabilidades podría aprovecharse para ejecutar código de forma remota dentro del contexto de las aplicaciones vulnerables, lo que podría resultar en un compromiso total del sistema.

Debido a la amenaza que representa un ataque exitoso, Oracle recomienda encarecidamente a los clientes que apliquen los parches de seguridad Critical Patch Update lo antes posible .

Para los ataques que requieren ciertos privilegios o acceso a ciertos paquetes, eliminar los privilegios o la capacidad de acceder a los paquetes de los usuarios que no necesitan los privilegios puede ayudar a reducir el riesgo de un ataque exitoso.

Próximas fechas

Los siguientes programas de actualización de parches críticos se publicarán en la fecha más cercana al día 17 de los siguientes meses:

20 de julio de 2021
19 de octubre de 2021
18 de enero de 2022

Las vulnerabilidades de seguridad mostradas en esta actualización de parche crítico y los productos afectados que en ella se describen, se encuentran enumerados y descritos en la documentación del mes de Abril de avisos de actualización de parches críticos que anexamos en el siguiente Link

Mitigación

El Centro de Ciberinteligencia de Entel CyberSecure recomienda lo siguiente:

Instalar las actualizaciones del fabricante disponibles en medios oficiales del proveedor, previo análisis del impacto que podría provocar en los servicios críticos para el negocio de su organización. Para ello consulte con su personal técnico o áreas resolutorias correspondientes.
Seguir instrucciones de Oracle con respecto a qué organizaciones prueben los cambios en los sistemas que no son de producción.

El listado de las CVE se adjunta a continuación:

Listado CVE

CVE-2021-2317
CVE-2021-2256
CVE-2020-1472
CVE-2021-2177
CVE-2021-2248
CVE-2019-17495
CVE-2020-28052
CVE-2020-11612
CVE-2019-0228
CVE-2019-0219
CVE-2019-17195
CVE-2020-11998
CVE-2020-5413
CVE-2019-3773
CVE-2020-9480
CVE-2020-10683
CVE-2021-2302
CVE-2021-2136
CVE-2021-2135
CVE-2018-1285
CVE-2020-17530
CVE-2019-2904
CVE-2021-2244
CVE-2021-2221
CVE-2019-17638
CVE-2021-2200
CVE-2021-2205
CVE-2020-1945
CVE-2021-2318
CVE-2021-2319
CVE-2021-2320
CVE-2021-2253
CVE-2020-5421
CVE-2021-22112
CVE-2019-5064
CVE-2020-26217
CVE-2020-10878
CVE-2021-2209
CVE-2021-2264
CVE-2020-10188
CVE-2021-2218
CVE-2021-2182
CVE-2021-2183
CVE-2021-2184
CVE-2021-2185
CVE-2021-2186
CVE-2021-2187
CVE-2021-2188
CVE-2021-2197
CVE-2021-2150
CVE-2021-2199
CVE-2021-2198
CVE-2021-2195
CVE-2021-2206
CVE-2021-2210
CVE-2021-2242
CVE-2021-2250
CVE-2020-24750
CVE-2021-2247
CVE-2021-2269
CVE-2021-2314
CVE-2021-2222
CVE-2021-2288
CVE-2021-2227
CVE-2021-2224
CVE-2021-2295
CVE-2021-2251
CVE-2021-2156
CVE-2021-2229
CVE-2021-2292
CVE-2021-2225
CVE-2021-2274
CVE-2021-2290
CVE-2021-2233
CVE-2021-2236
CVE-2021-2237
CVE-2021-2316
CVE-2021-2260
CVE-2021-2228
CVE-2021-2231
CVE-2021-2276
CVE-2021-2241
CVE-2021-2267
CVE-2021-2249
CVE-2021-2261
CVE-2021-2273
CVE-2021-2252
CVE-2021-2238
CVE-2021-2259
CVE-2021-2289
CVE-2021-2254
CVE-2021-2258
CVE-2021-2262
CVE-2021-2268
CVE-2021-2223
CVE-2021-2255
CVE-2021-2270
CVE-2021-2263
CVE-2021-2272
CVE-2021-2239
CVE-2021-2235
CVE-2021-2246
CVE-2021-2271
CVE-2020-28052
CVE-2020-14195
CVE-2021-2279
CVE-2021-2167
CVE-2021-2181
CVE-2020-5360
CVE-2020-17527
CVE-2020-13956
CVE-2020-11612
CVE-2021-22883
CVE-2019-12423
CVE-2020-13871
CVE-2020-11979
CVE-2020-25649
CVE-2020-1971
CVE-2020-1967
CVE-2021-2189
CVE-2021-2190
CVE-2020-11994
CVE-2019-17566
CVE-2018-20843
CVE-2021-2277
CVE-2018-1000180
CVE-2019-12402
CVE-2021-2157
CVE-2021-23841
CVE-2020-8277
CVE-2021-3449
CVE-2020-28196
CVE-2020-8286
CVE-2017-18640
CVE-2020-11987
CVE-2017-12626
CVE-2020-5398
CVE-2019-0227
CVE-2021-2309
CVE-2021-2145
CVE-2021-2310
CVE-2021-3450
CVE-2021-2219
CVE-2019-10086
CVE-2021-2008
CVE-2021-2240
CVE-2021-2144
CVE-2017-1000061
CVE-2021-2280
CVE-2021-2281
CVE-2021-2282
CVE-2021-2283
CVE-2021-2284
CVE-2021-2285
CVE-2021-2286
CVE-2021-2287
CVE-2021-2151
CVE-2019-3740
CVE-2021-2275
CVE-2021-2134
CVE-2020-5408
CVE-2021-2311
CVE-2021-2294
CVE-2021-2172
CVE-2021-2298
CVE-2021-2178
CVE-2021-2202
CVE-2019-10080
CVE-2020-8203
CVE-2019-3900
CVE-2020-11023
CVE-2020-11022
CVE-2020-27193
CVE-2020-13954
CVE-2020-1927
CVE-2017-14735
CVE-2021-2053
CVE-2021-2140
CVE-2019-0221
CVE-2021-2142
CVE-2020-9281
CVE-2021-2307
CVE-2021-2216
CVE-2016-7103
CVE-2019-11358
CVE-2021-2192
CVE-2021-2306
CVE-2021-2266
CVE-2016-5725
CVE-2021-2211
CVE-2021-2161
CVE-2020-1971
CVE-2020-17521
CVE-2020-9489
CVE-2020-27842
CVE-2021-20227
CVE-2021-2304
CVE-2021-2191
CVE-2021-2315
CVE-2021-2220
CVE-2021-2234
CVE-2020-27223
CVE-2020-13956
CVE-2020-11987
CVE-2021-2204
CVE-2021-2163
CVE-2019-7317
CVE-2021-2296
CVE-2021-2297
CVE-2021-2180
CVE-2021-2194
CVE-2021-2154
CVE-2021-2166
CVE-2021-2196
CVE-2021-2300
CVE-2021-2305
CVE-2021-2179
CVE-2021-2226
CVE-2021-2160
CVE-2021-2164
CVE-2021-2169
CVE-2021-2170
CVE-2021-2193
CVE-2021-2203
CVE-2021-2212
CVE-2021-2213
CVE-2021-2278
CVE-2021-2299
CVE-2021-2230
CVE-2021-2146
CVE-2021-2201
CVE-2021-2208
CVE-2021-2215
CVE-2021-2217
CVE-2021-2293
CVE-2021-2303
CVE-2020-27218
CVE-2021-2291
CVE-2021-2214
CVE-2021-2174
CVE-2021-2171
CVE-2021-2312
CVE-2020-7760
CVE-2021-2153
CVE-2021-2155
CVE-2021-2162
CVE-2020-1971
CVE-2021-2173
CVE-2021-2257
CVE-2021-2152
CVE-2021-2158
CVE-2020-9488
CVE-2021-2159
CVE-2020-8908
CVE-2021-2175
CVE-2021-2245
CVE-2021-2301
CVE-2021-2308
CVE-2021-2149
CVE-2021-2207
CVE-2021-2141
CVE-2021-2232
CVE-2021-2147

Tags: #Oracle #Parches #Actualización #Seguridad

Fuentes utilizadas

https://www.oracle.com/security-alerts/cpu...

Productos Afectados

Producto	Versión
Oracle Rapid Planning	12.1.3
Oracle Communications Session Router	Cz8.2 Cz8.3 Cz8.4
Oracle Retail Back Office	14.1
PeopleSoft Enterprise FIN Expenses	9.2
Oracle Secure	Backup
Enterprise Manager Ops Center	12.4.0.0
Oracle TimesTen In-Memory	Database
Oracle Retail Sales Audit	14.0
Oracle Platform Security for Java	11.1.1.9.0 12.2.1.3.0 12.2.1.4.0
Oracle Solaris	10 11
Oracle Communications Converged Application Server - Service Controller	6.2
Oracle API Gateway	11.1.2.4.0
Oracle GraalVM Enterprise Edition	19.3.5 20.3.1.2 21.0.0.2
Oracle Retail Merchandising System	16.0.3
Oracle Retail Insights Cloud Service Suite	19.0
MySQL Enterprise Monitor	8.0.23 y anteriores
Hyperion Analytic Provider Services	11.1.2.4 12.2.1.4
Oracle Retail Central Office	14.1
Oracle Global Lifecycle Management OPatch	anteriores a 12.2.0.1.22
Oracle NoSQL Database	anterior a 20.3
PeopleSoft Enterprise FIN Common Application Objects	9.2
Oracle Hospitality RES 3700	5.7.0-5.7.6
Oracle Java SE	7u291 8u281 11.0.10 16
Oracle Utilities Framework	4.2.0.2.0 4.2.0.3.0 4.3.0.1.0-4.3.0.6.0 4.4.0.0.0 4.4.0.2.0 4.4.0.3.0
Oracle Cloud Infrastructure Storage Gateway	anteriores a 1.4
OSS Support Tools	anterior a 2.12.41
Oracle Communications Subscriber-Aware Load Balancer	Cz8.2 Cz8.3 Cz8.4
Oracle Communications Design Studio	7.4.2
JD Edwards World Security	A9.4
Oracle Retail Store Inventory Management	14.1.3.10 15.0.3.5 16.0.3.5
Oracle Retail Category Management Planning & Optimization	16.0.3
Oracle Communications Application Session Controller	3.9m0p3
Oracle Graph	Server y Client
Oracle Communications Services Gatekeeper	6.0 6.1 7.0
Oracle SD-WAN Edge	8.2 9.0
Oracle Hospitality Cruise Shipboard Property Management System	20.1.0
Oracle FLEXCUBE Direct Banking	12.0.2 12.0.3
Oracle Financial Services Analytical Applications Infrastructure	8.0.6-8.1.0
Oracle Security Service	11.1.1.9.0 12.2.1.3.0 12.2.1.4.0
Oracle Hospitality OPERA 5	5.5 5.6
Enterprise Manager Base Platform	13.4.0.0
Oracle Communications Session Border Controller	Cz8.2 Cz8.3 Cz8.4
Oracle ZFS Storage Appliance Kit	8.8
Oracle Commerce Guided Search	11.3.0 11.3.1 11.3.2
PeopleSoft Enterprise SCM eProcurement	9.2
Primavera Gateway	17.12.0-17.12.10
Oracle Retail Macro Space Optimization	16.0.3
Oracle FLEXCUBE Private Banking	12.0.0 12.1.0
Oracle Retail Xstore Point of Service	15.0.4 16.0.6 17.0.4 18.0.3 19.0.2
PeopleSoft Enterprise PT PeopleTools	8.56 8.57 8.58
Oracle Agile PLM	9.3.3 9.3.5 9.3.6
Oracle Application Express	anteriores a 20.2
Oracle Retail Size Profile Optimization	16.0.3
Oracle BAM (Business Activity Monitoring)	11.1.1.9.0 12.2.1.3.0 12.2.1.4.0
Oracle Spatial Studio	anterior a 19.1.0 anterior a 20.1.1
Oracle Communications Performance Intelligence Center Software	10.4.0.2 10.4.0.3
Oracle Hospitality Inventory Management	9.1.0
Oracle Insurance Data Gateway	1.0.2.3
Oracle Retail Assortment Planning	16.0.3
PeopleSoft Enterprise PeopleTools	8.56 8.57 8.58
Oracle WebLogic Server	10.3.6.0.0 12.1.3.0.0 12.2.1.3.0 12.2.1.4.0 14.1.1.0.0
Oracle Secure Global Desktop	5.6
MySQL Server	5.7.33 y anteriores 8.0.23 y anteriores
Hyperion Financial Management	11.1.2.4
Oracle Storage Cloud Software Appliance	anterior a 16.3.1.4.2
Oracle Enterprise Session Border Controller	Cz8.2 Cz8.3 Cz8.4
Oracle Advanced Supply Chain Planning	12.1 12.2
Oracle SQL Developer	anterior a 20.4.1.407.6
Oracle WebCenter Portal	12.2.1.3.0 12.2.1.4.0
Enterprise Manager for Virtualization	13.4.0.0
MySQL Cluster	8.0.23 y anteriores
Oracle Retail Regular Price Optimization	16.0.3
Oracle Health Sciences Empirica Signal	9.0 9.1
Primavera Unifier	16.1 16.2 17.7-17.12 18.8 19.12 20.12
Oracle HTTP Server	11.1.1.9.0 12.2.1.3.0 12.2.1.4.0
Oracle Identity Manager Connector	11.1.1.5.0
PeopleSoft Enterprise CS Campus Community	9.2
Oracle Communications Unified Session Manager	SCz8.2.5
Oracle Communications Messaging Server	8.0.2 8.1 8.1.0
MySQL Workbench	8.0.23 y anteriores
Oracle Healthcare Foundation	7.1.5 7.2.2 7.3.0 7.3.1 8.0.1
Oracle Commerce Merchandising	0 11.0.0 11.1 11.2.0 11.3.0 11.3.1 11.3.2
Siebel Applications	21.2 y anteriores
Oracle Retail Replenishment Optimization	16.0.3
Oracle Retail Returns Management	14.1
Oracle Database Server	12.1.0.2 12.2.0.1 18c 19c
JD Edwards EnterpriseOne Orchestrator	anteriores a 9.2.5.3
Oracle Enterprise Communications Broker	PCZ3.1 PCZ3.2 PCZ3.3
Oracle Coherence	3.7.1.0 12.1.3.0.0 12.2.1.3.0 12.2.1.4.0 14.1.1.0.0
Oracle Retail Point-of-Service	14.1
Oracle Communications MetaSolv Solution	6.3.0 6.3.1
Oracle Application Testing Suite	13.3.0.1
Oracle Fusion Middleware MapViewer	12.2.1.4.0
Oracle iLearning	6.2 6.3
Oracle Fusion Middleware	11.1.1.9.0 12.2.1.3.0 12.2.1.4.0
Oracle Retail Merchandise Financial Planning	16.0.3
Oracle Banking Platform	2.4.0 2.6.2 2.7.0 2.7.1 2.8.0 2.9.0 2.10.0
Oracle VM VirtualBox	anterior a 6.1.20
Oracle E-Business Suite	12.1.1-12.1.3 12.2.3-12.2.10
Oracle Enterprise Repository	11.1.1.7.0
Oracle SD-WAN Aware	8.2
Enterprise Manager for Fusion Middleware	12.2.1.4 13.4.0.0
Oracle Communications Interactive Session Recorder	6.3 6.4
Oracle Retail Item Planning	16.0.3
Oracle Service Bus	11.1.1.9.0 12.2.1.3.0 12.2.1.4.0
Oracle Retail Predictive Application Server	14.1 15.0 16.0
Oracle REST Data Services	anterior a 20.4.3.50.1904
Oracle Communications Contacts Server	8.0
Oracle Retail EFTLink	15.0.2 16.0.3 17.0.2 18.0.1 19.0.1 20.0.0
PeopleSoft Enterprise SCM Purchasing	9.2
Oracle Health Sciences Information Manager	3.0.0-3.0.2
Oracle Endeca Information Discovery Studio	3.2.0.0
Oracle Business Intelligence Enterprise Edition	5.5.0.0.0 11.1.1.9.0 12.2.1.3.0 12.2.1.4.0
JD Edwards EnterpriseOne Tools	anteriores a 9.2.4.0 anteriores a 9.2.5.3
Oracle Java SE Embedded	8u281
Oracle Communications Calendar Server	8.0
Agile Product Lifecycle Management Integration Pack for Oracle E-Business Suite	3.5 3.6
Agile Product Lifecycle Management Integration Pack for SAP Design to Release	3.5 3.6
FMW Platform	12.2.1.3.0 12.2.1.4.0
Oracle Communications Unified Inventory Management	7.3.4 7.3.5 7.4.0 7.4.1
Instantis EnterpriseTrack	17.1 17.2 17.3
Oracle WebLogic Server Proxy Plug-In	11.1.1.9.0 12.2.1.3.0 12.2.1.4.0
Oracle Outside In Technology	8.5.5
Oracle Retail Advanced Inventory Planning	14.1