Oracle – Intelligent Systems Monitoring

Oracle Critical Patch Update Advisory – July 2021

July 19, 2021September 28, 2021 Oracle Leave a comment

Oracle Critical Patch Update Advisory – July 2021

Description

A Critical Patch Update is a collection of patches for multiple security vulnerabilities. These patches address vulnerabilities in Oracle code and in third-party components included in Oracle products. These patches are usually cumulative, but each advisory describes only the security patches added since the previous Critical Patch Update Advisory. Thus, prior Critical Patch Update advisories should be reviewed for information regarding earlier published security patches. Refer to “Critical Patch Updates, Security Alerts and Bulletins” for information about Oracle Security advisories.

Oracle continues to periodically receive reports of attempts to maliciously exploit vulnerabilities for which Oracle has already released security patches. In some instances, it has been reported that attackers have been successful because targeted customers had failed to apply available Oracle patches. Oracle therefore strongly recommends that customers remain on actively-supported versions and apply Critical Patch Update security patches without delay.

This Critical Patch Update contains 342 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at July 2021 Critical Patch Update: Executive Summary and Analysis.

Affected Products and Patch Information

Security vulnerabilities addressed by this Critical Patch Update affect the products listed below. The product area is shown in the Patch Availability Document column.

Please click on the links in the Patch Availability Document column below to access the documentation for patch availability information and installation instructions.

Affected Products and Versions	Patch Availability Document
Big Data Spatial and Graph, versions prior to 2.0, prior to 23.1	Database
Enterprise Manager Base Platform, version 13.4.0.0	Enterprise Manager
Essbase, version 21.2	Database
Essbase Analytic Provider Services, versions 11.1.2.4, 21.2	Database
Fujitsu M10-1, M10-4, M10-4S, M12-1, M12-2, M12-2S Servers, versions prior to XCP2400, prior to XCP3100	Systems
Hyperion Essbase Administration Services, versions 11.1.2.4, 21.2	Database
Hyperion Financial Reporting, versions 11.1.2.4, 11.2.5.0	Fusion Middleware
Hyperion Infrastructure Technology, versions 11.1.2.4, 11.2.5.0	Fusion Middleware
Identity Manager, versions 11.1.2.2.0, 11.1.2.3.0, 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Instantis EnterpriseTrack, versions 17.1, 17.2, 17.3	Oracle Construction and Engineering Suite
JD Edwards EnterpriseOne Orchestrator, versions 9.2.5.3 and prior	JD Edwards
JD Edwards EnterpriseOne Tools, versions 9.2.5.3 and prior	JD Edwards
MICROS Compact Workstation 3, version 310	MICROS Compact Workstation
MICROS ES400 Series, versions 400-410	MICROS ES400 Series
MICROS Kitchen Display System Hardware, version 210	MICROS Kitchen Display System Hardware
MICROS Workstation 5A, version 5A	MICROS Workstation 5A
MICROS Workstation 6, versions 610-655	MICROS Workstation
MySQL Cluster, versions 8.0.25 and prior	MySQL
MySQL Connectors, versions 8.0.23 and prior	MySQL
MySQL Enterprise Monitor, versions 8.0.23 and prior	MySQL
MySQL Server, versions 5.7.34 and prior, 8.0.25 and prior	MySQL
Oracle Access Manager, version 11.1.2.3.0	Fusion Middleware
Oracle Agile Engineering Data Management, version 6.2.1.0	Oracle Supply Chain Products
Oracle Agile PLM, versions 9.3.3, 9.3.5, 9.3.6	Oracle Supply Chain Products
Oracle Application Express, versions prior to 21.1.0.0.4	Database
Oracle Application Express (CKEditor), versions prior to 21.1.0.0.1	Database
Oracle Application Express Application Builder (DOMPurify), versions prior to 21.1.0.0.1	Database
Oracle Application Testing Suite, version 13.3.0.1	Enterprise Manager
Oracle BAM (Business Activity Monitoring), versions 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Oracle Banking Enterprise Default Management, versions 2.10.0, 2.12.0	Oracle Banking Platform
Oracle Banking Liquidity Management, versions 14.2, 14.3, 14.5	Contact Support
Oracle Banking Party Management, version 2.7.0	Oracle Banking Platform
Oracle Banking Platform, versions 2.4.0, 2.7.1, 2.9.0, 2.12.0	Oracle Banking Platform
Oracle Banking Treasury Management, version 14.4	Contact Support
Oracle BI Publisher, versions 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Oracle Business Intelligence Enterprise Edition, version 12.2.1.4.0	Fusion Middleware
Oracle Coherence, versions 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0	Fusion Middleware
Oracle Commerce Guided Search, version 11.3.2	Oracle Commerce
Oracle Commerce Guided Search / Oracle Commerce Experience Manager, versions 11.3.1.5, 11.3.2	Oracle Commerce
Oracle Commerce Merchandising, versions 11.1.0, 11.2.0, 11.3.0-11.3.2	Oracle Commerce
Oracle Commerce Platform, versions 11.0.0, 11.1.0, 11.2.0, 11.3.0-11.3.2	Oracle Commerce
Oracle Commerce Service Center, versions 11.0.0, 11.1.0, 11.2.0, 11.3.0-11.3.2	Oracle Commerce
Oracle Communications Application Session Controller, version 3.9	Oracle Communications Application Session Controller
Oracle Communications Billing and Revenue Management, versions 7.5.0.23.0, 12.0.0.3.0	Oracle Communications Billing and Revenue Management
Oracle Communications BRM – Elastic Charging Engine, versions 11.3.0.9.0, 12.0.0.3.0	Oracle Communications BRM – Elastic Charging Engine
Oracle Communications Cloud Native Core Console, version 1.4.0	Communications Cloud Native Core Console
Oracle Communications Cloud Native Core Network Function Cloud Native Environment, versions 1.4.0, 1.7.0	Oracle Communications Cloud Native Core Network Function Cloud Native Environment
Oracle Communications Cloud Native Core Network Slice Selection Function, version 1.2.1	Communications Cloud Native Core Network Slice Selection Function
Oracle Communications Cloud Native Core Policy, versions 1.5.0, 1.9.0	Communications Cloud Native Core Policy
Oracle Communications Cloud Native Core Security Edge Protection Proxy, version 1.7.0	Communications Cloud Native Core Security Edge Protection Proxy
Oracle Communications Cloud Native Core Service Communication Proxy, version 1.5.2	Communications Cloud Native Core Service Communication Proxy
Oracle Communications Cloud Native Core Unified Data Repository, versions 1.4.0, 1.6.0	Communications Cloud Native Core Unified Data Repository
Oracle Communications Convergent Charging Controller, version 12.0.4.0.0	Oracle Communications Convergent Charging Controller
Oracle Communications Design Studio, version 7.4.2	Oracle Communications Design Studio
Oracle Communications Diameter Signaling Router (DSR), versions 8.0.0-8.5.0	Oracle Communications Diameter Signaling Router
Oracle Communications EAGLE Software, versions 46.6.0-46.8.2	Oracle Communications EAGLE
Oracle Communications Evolved Communications Application Server, version 7.1	Oracle Communications Evolved Communications Application Server
Oracle Communications Instant Messaging Server, version 10.0.1.4.0	Oracle Communications Instant Messaging Server
Oracle Communications Network Charging and Control, versions 6.0.1.0, 12.0.1.0-12.0.4.0, 12.0.4.0.0	Oracle Communications Network Charging and Control
Oracle Communications Offline Mediation Controller, version 12.0.0.3.0	Oracle Communications Offline Mediation Controller
Oracle Communications Pricing Design Center, version 12.0.0.3.0	Oracle Communications Pricing Design Center
Oracle Communications Services Gatekeeper, versions 7.0	Oracle Communications Services Gatekeeper
Oracle Communications Unified Inventory Management, versions 7.3.2, 7.3.4, 7.3.5, 7.4.0, 7.4.1	Oracle Communications Unified Inventory Management
Oracle Configuration Manager, version 12.1.2.0.8	Enterprise Manager
Oracle Data Integrator, versions 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Oracle Database Server, versions 12.1.0.2, 12.2.0.1, 19c	Database
Oracle E-Business Suite, versions 12.1.1-12.1.3, 12.2.3-12.2.10	Oracle E-Business Suite
Oracle Enterprise Data Quality, versions 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Oracle Enterprise Repository, version 11.1.1.7.0	Fusion Middleware
Oracle Financial Services Analytical Applications Infrastructure, versions 8.0.6-8.0.9, 8.1.0, 8.1.1	Oracle Financial Services Analytical Applications Infrastructure
Oracle Financial Services Crime and Compliance Investigation Hub, version 20.1.2	Oracle Financial Services Crime and Compliance Investigation Hub
Oracle Financial Services Regulatory Reporting with AgileREPORTER, version 8.0.9.6.3	Oracle Financial Services Regulatory Reporting with AgileREPORTER
Oracle Financial Services Revenue Management and Billing Analytics, versions 2.7.0, 2.8.0	Oracle Financial Services Revenue Management and Billing Analytics
Oracle FLEXCUBE Private Banking, versions 12.0.0, 12.1.0	Contact Support
Oracle FLEXCUBE Universal Banking, versions 12.0-12.4, 14.0-14.4.0	Contact Support
Oracle Fusion Middleware MapViewer, version 12.2.1.4.0	Fusion Middleware
Oracle GoldenGate Application Adapters, version 19.1.0.0.0	Fusion Middleware
Oracle GraalVM Enterprise Edition, versions 20.3.2, 21.1.0	Java SE
Oracle Hospitality Reporting and Analytics, version 9.1.0	Oracle Hospitality Reporting and Analytics
Oracle Hospitality Suite8, versions 8.13, 8.14	MICROS BellaVita
Oracle Hyperion BI+, versions 11.1.2.4, 11.2.5.0	Fusion Middleware
Oracle Insurance Policy Administration, versions 11.0.2, 11.1.0-11.3.0	Oracle Insurance Applications
Oracle Insurance Policy Administration J2EE, version 11.0.2	Oracle Insurance Applications
Oracle Insurance Rules Palette, versions 11.0.2, 11.1.0-11.3.0	Oracle Insurance Applications
Oracle Java SE, versions 7u301, 8u291, 11.0.11, 16.0.1	Java SE
Oracle JDeveloper, versions 12.2.1.4.0	Fusion Middleware
Oracle Managed File Transfer, versions 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Oracle Outside In Technology, version 8.5.5	Fusion Middleware
Oracle Policy Automation, versions 12.2.0-12.2.22	Oracle Policy Automation
Oracle Retail Back Office, version 14.1	Retail Applications
Oracle Retail Central Office, version 14.1	Retail Applications
Oracle Retail Customer Engagement, versions 16.0-19.0	Retail Applications
Oracle Retail Customer Management and Segmentation Foundation, versions 16.0-19.0	Retail Applications
Oracle Retail Financial Integration, versions 14.1.3.2, 15.0.3.1, 16.0.3.0	Retail Applications
Oracle Retail Integration Bus, versions 14.1.3.2, 15.0.3.1, 16.0.3.0	Retail Applications
Oracle Retail Merchandising System, versions 14.1.3.2, 15.0.3.1, 16.0.3	Retail Applications
Oracle Retail Order Broker, versions 15.0, 16.0	Retail Applications
Oracle Retail Order Management System Cloud Service, version 19.5	Retail Applications
Oracle Retail Point-of-Service, version 14.1	Retail Applications
Oracle Retail Price Management, versions 14.0, 14.1, 15.0, 16.0	Retail Applications
Oracle Retail Returns Management, version 14.1	Retail Applications
Oracle Retail Service Backbone, versions 14.1.3.2, 15.0.3.1, 16.0.3.0	Retail Applications
Oracle Retail Xstore Point of Service, versions 16.0.6, 17.0.4, 18.0.3, 19.0.2, 20.0.1	Retail Applications
Oracle SD-WAN Aware, versions 8.2, 9.0	Oracle SD-WAN Aware
Oracle SD-WAN Edge, versions 8.2, 9.0, 9.1	Oracle SD-WAN Edge
Oracle Secure Global Desktop, version 5.6	Virtualization
Oracle Solaris, version 11	Systems
Oracle Solaris Cluster, version 4.4	Systems
Oracle Transportation Management, version 6.4.3	Oracle Supply Chain Products
Oracle VM VirtualBox, versions prior to 6.1.24	Virtualization
Oracle WebCenter Portal, versions 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Oracle WebLogic Server, versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0	Fusion Middleware
Oracle ZFS Storage Appliance Kit, version 8.8	Systems
OSS Support Tools, versions prior to 2.12.41	Support Tools
PeopleSoft Enterprise CS Campus Community, versions 9.0, 9.2	PeopleSoft
PeopleSoft Enterprise HCM Candidate Gateway, version 9.2	PeopleSoft
PeopleSoft Enterprise HCM Shared Components, version 9.2	PeopleSoft
PeopleSoft Enterprise PeopleTools, versions 8.57, 8.58, 8.58.8.59, 8.59	PeopleSoft
PeopleSoft Enterprise PT PeopleTools, versions 8.57, 8.58, 8.59	PeopleSoft
Primavera Gateway, versions 17.12.0-17.12.11, 18.8.0-18.8.11, 19.12.0-19.12.10, 20.12.0	Oracle Construction and Engineering Suite
Primavera P6 Enterprise Project Portfolio Management, versions 17.12.0-17.12.20, 18.8.0-18.8.23, 19.12.0-19.12.14, 20.12.0-20.12.3	Oracle Construction and Engineering Suite
Primavera Unifier, versions 17.7-17.12, 18.8, 19.12, 20.12	Oracle Construction and Engineering Suite
Real-Time Decisions (RTD) Solutions, version 3.2.0.0	Fusion Middleware
Siebel Applications, versions 21.5 and prior	Siebel
StorageTek Tape Analytics SW Tool, version 2.3	Systems

Note:

Vulnerabilities affecting either Oracle Database or Oracle Fusion Middleware may affect Oracle Fusion Applications, so Oracle customers should refer to Oracle Fusion Applications Critical Patch Update Knowledge Document, My Oracle Support Note 1967316.1 for information on patches to be applied to Fusion Application environments.
Vulnerabilities affecting Oracle Solaris may affect Oracle ZFSSA so Oracle customers should refer to the Oracle and Sun Systems Product Suite Critical Patch Update Knowledge Document, My Oracle Support Note 2160904.1 for information on minimum revisions of security patches required to resolve ZFSSA issues published in Critical Patch Updates and Solaris Third Party bulletins.
Solaris Third Party Bulletins are used to announce security patches for third party software distributed with Oracle Solaris. Solaris 10 customers should refer to the latest patch-sets which contain critical security fixes and detailed in Systems Patch Availability Document. Please see Reference Index of CVE IDs and Solaris Patches (My Oracle Support Note 1448883.1) for more information.
Users running Java SE with a browser can download the latest release from https://java.com. Users on the Windows and Mac OS X platforms can also use automatic updates to get the latest release.

Risk Matrix Content

Risk matrices list only security vulnerabilities that are newly addressed by the patches associated with this advisory. Risk matrices for previous security patches can be found in previous Critical Patch Update advisories and Alerts. An English text version of the risk matrices provided in this document is here.

Several vulnerabilities addressed in this Critical Patch Update affect multiple products. Each vulnerability is identified by a CVE# which is its unique identifier. A vulnerability that affects multiple products will appear with the same CVE# in all risk matrices. A CVE# shown in italics indicates that this vulnerability impacts a different product, but also has impact on the product where the italicized CVE# is listed.

Security vulnerabilities are scored using CVSS version 3.1 (see Oracle CVSS Scoring for an explanation of how Oracle applies CVSS version 3.1).

Oracle conducts an analysis of each security vulnerability addressed by a Critical Patch Update. Oracle does not disclose detailed information about this security analysis to customers, but the resulting Risk Matrix and associated documentation provide information about the type of vulnerability, the conditions required to exploit it, and the potential impact of a successful exploit. Oracle provides this information, in part, so that customers may conduct their own risk analysis based on the particulars of their product usage. For more information, see Oracle vulnerability disclosure policies.

Oracle lists updates that address vulnerabilities in third-party components that are not exploitable in the context of their inclusion in their respective Oracle product beneath the product’s risk matrix.

The protocol in the risk matrix implies that all of its secure variants (if applicable) are affected as well. For example, if HTTP is listed as an affected protocol, it implies that HTTPS (if applicable) is also affected. The secure variant of a protocol is listed in the risk matrix only if it is the only variant affected, e.g. HTTPS will typically be listed for vulnerabilities in SSL and TLS.

Workarounds

Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply Critical Patch Update security patches as soon as possible. Until you apply the Critical Patch Update patches, it may be possible to reduce the risk of successful attack by blocking network protocols required by an attack. For attacks that require certain privileges or access to certain packages, removing the privileges or the ability to access the packages from users that do not need the privileges may help reduce the risk of successful attack. Both approaches may break application functionality, so Oracle strongly recommends that customers test changes on non-production systems. Neither approach should be considered a long-term solution as neither corrects the underlying problem.

Skipped Critical Patch Updates

Oracle strongly recommends that customers apply security patches as soon as possible. For customers that have skipped one or more Critical Patch Updates and are concerned about products that do not have security patches announced in this Critical Patch Update, please review previous Critical Patch Update advisories to determine appropriate actions.

Critical Patch Update Supported Products and Versions

Patches released through the Critical Patch Update program are provided only for product versions that are covered under the Premier Support or Extended Support phases of the Lifetime Support Policy. Oracle recommends that customers plan product upgrades to ensure that patches released through the Critical Patch Update program are available for the versions they are currently running.

Product releases that are not under Premier Support or Extended Support are not tested for the presence of vulnerabilities addressed by this Critical Patch Update. However, it is likely that earlier versions of affected releases are also affected by these vulnerabilities. As a result, Oracle recommends that customers upgrade to supported versions.

Database, Fusion Middleware, and Oracle Enterprise Manager products are patched in accordance with the Software Error Correction Support Policy explained in My Oracle Support Note 209768.1. Please review the Technical Support Policies for further guidelines regarding support policies and phases of support.

Credit Statement

The following people or organizations reported security vulnerabilities addressed by this Critical Patch Update to Oracle:

0xfoxone: CVE-2021-2452
Andrej Simko of Accenture: CVE-2021-2436
Anonymous researcher working with Trend Micro’s Zero Day Initiative: CVE-2021-2389, CVE-2021-2390, CVE-2021-2429
Armaan Khurshid Pathan of Emirates Group: CVE-2021-2373
Billy Jheng Bing Jhong of STAR Labs: CVE-2021-2443
Devin Rosenbauer of Identity Works LLC: CVE-2021-2457
Dimitris Doganos of COSMOTE – Mobile Telecommunications S.A.: CVE-2021-2345, CVE-2021-2346, CVE-2021-2348
Eddie Zhu of Beijing DBSEC Technology Co., Ltd: CVE-2021-2328, CVE-2021-2329, CVE-2021-2333, CVE-2021-2337
Emad Al-Mousa: CVE-2021-2326
Faraz Khan from Emirates Group: CVE-2021-2375
Filip Ceglik: CVE-2021-2448
Gianluca Danesin of Mondadori: CVE-2021-2412
Girlelecta: CVE-2021-2419, CVE-2021-2420, CVE-2021-2423, CVE-2021-2430, CVE-2021-2431, CVE-2021-2449, CVE-2021-2450, CVE-2021-2451, CVE-2021-2453
Guillaume Jacques of synacktiv: CVE-2021-2435
Haya Shulman of Fraunhofer.de: CVE-2021-2432
Huixin Ma of Tencent.com: CVE-2021-2388
Jang Laptop of VNPT ISC working with Trend Micro Zero Day Initiative: CVE-2021-2400, CVE-2021-2401
Kajetan Rostojek: CVE-2021-2349, CVE-2021-2350
KPC of Trend Micro’s Zero Day Initiative: CVE-2021-2392
Li Boheng of Tophant Starlight laboratory : CVE-2021-2394
Longofo of Knownsec 404 Team: CVE-2021-2376, CVE-2021-2403, CVE-2021-2428, CVE-2021-2433, CVE-2021-2456
Maciej Grabiec of ING Tech Poland: CVE-2021-2350
Markus Loewe: CVE-2021-2369
Martin Neumann of Accenture: CVE-2021-2359
Matthias Kaiser of Apple Information Security: CVE-2021-2394, CVE-2021-2397
Max Van Amerongen (maxpl0it): CVE-2021-2442
Mohit Rawat: CVE-2021-2458
Moritz Bechler of SySS GmbH: CVE-2021-2351
Okan Basegmez: CVE-2021-2334, CVE-2021-2335, CVE-2021-2336
Paul Barbé of synacktiv: CVE-2021-2347, CVE-2021-2435, CVE-2021-2439, CVE-2021-2445
Peterjson of RedTeam@VNG Corporation working with Trend Micro Zero Day Initiative: CVE-2021-2456
Philipp Jeitner of Fraunhofer.de: CVE-2021-2432
Qiguang Zhu: CVE-2021-2333
Quynh Le of VNPT ISC working with Trend Micro Zero Day Initiative: CVE-2021-2391, CVE-2021-2396
r00t4dm at Cloud-Penetrating Arrow Lab: CVE-2021-2376, CVE-2021-2403, CVE-2021-2428, CVE-2021-2433, CVE-2021-2456
thiscodecc of MoyunSec V-Lab: CVE-2021-2382, CVE-2021-2394
threedr3am: CVE-2021-2344, CVE-2021-2371, CVE-2021-2376, CVE-2021-2378
Théo Louis-Tisserand of synacktiv: CVE-2021-2435
Varnavas Papaioannou: CVE-2021-2341
Ved Prabhu: CVE-2021-2460
Vishnu Dev T J working with Trend Micro’s Zero Day Initiative: CVE-2021-2409
Waleed Ezz Eldin of Cysiv (Previously SecureMisr): CVE-2021-2380
Yaoguang Chen of Ant Security Light-Year Lab: CVE-2021-2330, CVE-2021-2357, CVE-2021-2444

Security-In-Depth Contributors

Oracle acknowledges people who have contributed to our Security-In-Depth program (see FAQ). People are acknowledged for Security-In-Depth contributions if they provide information, observations or suggestions pertaining to security vulnerability issues that result in significant modification of Oracle code or documentation in future releases, but are not of such a critical nature that they are distributed in Critical Patch Updates.

In this Critical Patch Update, Oracle recognizes the following for contributions to Oracle’s Security-In-Depth program:

Aleksey Shipilev of Red Hat
Brian Reilly [2 reports]
Emad Al-Mousa
Markus Loewe [2 reports]
threedr3am [3 reports]

On-Line Presence Security Contributors

Oracle acknowledges people who have contributed to our On-Line Presence Security program (see FAQ). People are acknowledged for contributions relating to Oracle’s on-line presence if they provide information, observations or suggestions pertaining to security-related issues that result in significant modification to Oracle’s on-line external-facing systems.

For this quarter, Oracle recognizes the following for contributions to Oracle’s On-Line Presence Security program:

Abhishek Morla
Adeel Khan
Ashik Kunjumon
Boumediene Kaddour
Gaurang Maheta of gaurang maheta
Hamoud Al-Helmani
Husnain Iqbal
Information Security Management
Khalid matar Alharthi
Marwan Albahar
Mohamed Ahmed Naji
Naman Shah
Nik Czuprinski
Pratik Khalane [2 reports]
Rajnish Kumar Gupta
Rakan Abdulrahman Al Khaled
Sakhare Vinayak
Snigdha Priya
Sohamin Durkar
Stefano Barber
Tech Zone
Vivek Panday
Yash Sharma [2 reports]
Zach Edwards of victorymedium.com
Zoe Pentaleri

Critical Patch Update Schedule

Critical Patch Updates are released on the Tuesday closest to the 17th day of January, April, July and October. The next four dates are:

19 October 2021
18 January 2022
19 April 2022
19 July 2022

References

Modification History

Date	Note
2021-September-03	Rev 7. Removed additional CVEs of the patch for CVE-2019-17195
2021-August-18	Rev 6. Updated CVSS scores for Outside In Technology
2021-July-30	Rev 5. Updated affected version for Oracle Communications Services Gatekeeper
2021-July-26	Rev 4. Removed Oracle JDeveloper version 12.2.1.3.0, updated Credit Statement
2021-July-23	Rev 3. Removed Oracle JDeveloper and ADF entry from the product table. Updated Credit Statement.
2021-July-21	Rev 2. Updated Credit Statement, Oracle BI Publisher affected versions updated, MOS note numbers updated
2021-July-20	Rev 1. Initial Release.

Oracle Database Products Risk Matrices

This Critical Patch Update contains 27 new security patches for Oracle Database Products divided as follows:

16 new security patches for Oracle Database Products
2 new security patches for Oracle Big Data Graph
9 new security patches for Oracle Essbase

Oracle Database Server Risk Matrix

This Critical Patch Update contains 16 new security patches plus additional third party patches noted below for Oracle Database Products. 1 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. 1 of these patches is applicable to client-only installations, i.e., installations that do not have the Oracle Database Server installed. The English text form of this Risk Matrix can be found here.

CVE#	Component	Package and/or Privilege Required	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Component	Package and/or Privilege Required	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2021-2351	Advanced Networking Option	None	Oracle Net	Yes	8.3	Network	High	None	Required	Changed	High	High	High	12.1.0.2, 12.2.0.1, 19c	See Note 1
CVE-2021-2328	Oracle Text	Create Any Procedure, Alter Any Table	Oracle Net	No	7.2	Network	Low	High	None	Un- changed	High	High	High	12.1.0.2, 12.2.0.1, 19c
CVE-2021-2329	Oracle XML DB	Create Any Procedure, Create Public Synonym	Oracle Net	No	7.2	Network	Low	High	None	Un- changed	High	High	High	12.1.0.2, 12.2.0.1, 19c
CVE-2021-2337	Oracle XML DB	Create Any Procedure, Create Public Synonym	Oracle Net	No	7.2	Network	Low	High	None	Un- changed	High	High	High	12.1.0.2, 12.2.0.1, 19c
CVE-2020-27193	Oracle Application Express (CKEditor)	Valid User Account	HTTP	No	5.4	Network	Low	Low	Required	Changed	Low	Low	None	Prior to 21.1.0.00.01
CVE-2020-26870	Oracle Application Express Application Builder (DOMPurify)	Valid User Account	HTTP	No	5.4	Network	Low	Low	Required	Changed	Low	Low	None	Prior to 21.1.0.00.01
CVE-2021-2460	Oracle Application Express Data Reporter	Valid User Account	HTTP	No	5.4	Network	Low	Low	Required	Changed	Low	Low	None	Prior to 21.1.0.00.04
CVE-2021-2333	Oracle XML DB	Alter User	Oracle Net	No	4.9	Network	Low	High	None	Un- changed	High	None	None	12.1.0.2, 12.2.0.1, 19c
CVE-2019-17545	Oracle Spatial and Graph (GDAL)	Create Session	Oracle Net	No	4.4	Local	High	Low	Required	Un- changed	None	None	High	12.2.0.1, 19c
CVE-2021-2330	Core RDBMS	Create Table	Oracle Net	No	4.3	Network	Low	Low	None	Un- changed	None	None	Low	19c
CVE-2020-7760	Enterprise Manager Express User Interface (CodeMirror)	User Account	HTTP	No	4.3	Network	Low	Low	None	Un- changed	None	None	Low	19c
CVE-2021-2438	Java VM	Create Procedure	Oracle Net	No	4.3	Network	Low	Low	None	Un- changed	None	None	Low	12.1.0.2, 12.2.0.1, 19c
CVE-2021-2334	Oracle Database – Enterprise Edition Data Redaction	Create Session	Oracle Net	No	3.5	Network	Low	Low	Required	Un- changed	None	Low	None	12.1.0.2, 12.2.0.1, 19c
CVE-2021-2335	Oracle Database – Enterprise Edition Data Redaction	Create Session	Oracle Net	No	3.5	Network	Low	Low	Required	Un- changed	None	Low	None	12.1.0.2, 12.2.0.1, 19c
CVE-2021-2336	Oracle Database – Enterprise Edition Data Redaction	Create Session	Oracle Net	No	3.5	Network	Low	Low	Required	Un- changed	None	Low	None	12.1.0.2, 12.2.0.1, 19c
CVE-2021-2326	Database Vault	DBA	Oracle Net	No	2.7	Network	Low	High	None	Un- changed	Low	None	None	12.2.0.1, 19c

Notes:

The July 2021 Critical Patch Update introduces a number of Native Network Encryption changes to deal with vulnerability CVE-2021-2351 and prevent the use of weaker ciphers. Customers should review: “Changes in Native Network Encryption with the July 2021 Critical Patch Update” (Doc ID 2791571.1).

Additional patches are included in this Critical Patch Update for the following non-exploitable CVEs in this Oracle product family:

MapViewer (OWASP ESAPI)Oracle Spatial and Graph (OpenJPEG): CVE-2020-27844, CVE-2018-21010, CVE-2019-12973, CVE-2020-15389, CVE-2020-27814, CVE-2020-27841, CVE-2020-27842, CVE-2020-27843 and CVE-2020-27845.
Oracle Database – Enterprise Edition (Kerberos): CVE-2020-28196.
Oracle Database Migration Assistant for Unicode (Apache POI): CVE-2019-12415.
Oracle Spatial and Graph (jackson-databind): CVE-2020-25649.
Oracle Spatial and Graph MapViewer (Apache Batik): CVE-2020-11987 and CVE-2019-17566.
Oracle Spatial and Graph MapViewer (Apache HttpClient): CVE-2020-13956.
Oracle Spatial and Graph MapViewer (Apache XMLGraphics Commons): CVE-2020-11988.
Oracle Spatial and Graph MapViewer (Google Guava): CVE-2020-8908.
Oracle Spatial and Graph Network Data Model (jackson-databind): CVE-2020-25649.
RDBMS (Perl): CVE-2020-10878, CVE-2020-10543 and CVE-2020-12723.
RDBMS (Python): CVE-2021-23336.

Oracle Database Server Client-Only Installations

The following Oracle Database Server vulnerability included in this Critical Patch Update affects client-only installations: CVE-2021-2351.

Oracle Big Data Graph Risk Matrix

This Critical Patch Update contains 2 new security patches plus additional third party patches noted below for Oracle Big Data Graph. Both of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2019-5064	Big Data Spatial and Graph	Big Data Graph (OpenCV)	HTTP	Yes	8.8	Network	Low	None	Required	Un- changed	High	High	High	Prior to 2.0
CVE-2020-17527	Big Data Spatial and Graph	Big Data Graph (Apache Tomcat)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	High	None	None	Prior to 23.1

Additional CVEs addressed are:

The patch for CVE-2019-5064 also addresses CVE-2019-5063.

Additional patches are included in this Critical Patch Update for the following non-exploitable CVEs in this Oracle product family:

Big Data Spatial and Graph
- Big Data Graph (Lodash): CVE-2020-8203.
- Big Data Graph (jackson-databind): CVE-2020-25649, CVE-2020-35490, CVE-2020-35491, CVE-2020-35728, CVE-2020-36179, CVE-2020-36180, CVE-2020-36181, CVE-2020-36182, CVE-2020-36183, CVE-2020-36184, CVE-2020-36185, CVE-2020-36186, CVE-2020-36187, CVE-2020-36188 and CVE-2020-36189.

Oracle Essbase Risk Matrix

This Critical Patch Update contains 9 new security patches for Oracle Essbase. 8 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2021-2244	Essbase Analytic Provider Services	JAPI	HTTP	Yes	10.0	Network	Low	None	None	Changed	High	High	High	21.2
CVE-2021-2349	Hyperion Essbase Administration Services	EAS Console	HTTP	Yes	8.6	Network	Low	None	None	Changed	High	None	None	11.1.2.4, 21.2
CVE-2021-2435	Essbase Analytic Provider Services	JAPI	HTTP	Yes	8.1	Network	Low	None	Required	Un- changed	High	High	None	11.1.2.4
CVE-2019-0190	Essbase	Infrastructure (OpenSSL)	HTTPS	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	21.2
CVE-2020-8285	Essbase	Infrastructure (cURL)	Multiple	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	21.2
CVE-2021-2433	Essbase Analytic Provider Services	Web Services	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	11.1.2.4, 21.2
CVE-2021-2350	Hyperion Essbase Administration Services	EAS Console	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	High	None	None	11.1.2.4, 21.2
CVE-2020-7760	Essbase	Infrastructure (CodeMirror)	HTTP	Yes	5.3	Network	Low	None	None	Un- changed	None	None	Low	21.2
CVE-2019-12402	Essbase	Infrastructure (Apache Commons Compress)	HTTP	No	4.1	Adjacent Network	Low	Low	Required	Un- changed	None	Low	Low	21.2

Additional CVEs addressed are:

The patch for CVE-2019-0190 also addresses CVE-2020-1971, CVE-2021-23840, CVE-2021-23841, CVE-2021-3449 and CVE-2021-3450.
The patch for CVE-2020-8285 also addresses CVE-2020-8284, CVE-2020-8286, CVE-2021-22876 and CVE-2021-22890.

Oracle Commerce Risk Matrix

This Critical Patch Update contains 11 new security patches for Oracle Commerce. 8 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2021-2463	Oracle Commerce Platform	Dynamo Application Framework	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	11.0.0, 11.1.0, 11.2.0, 11.3.0-11.3.2
CVE-2020-2555	Oracle Commerce Platform	Dynamo Application Framework (Coherence)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	11.0.0, 11.1.0, 11.2.0, 11.3.0-11.3.2
CVE-2020-2604	Oracle Commerce Guided Search	Content Acquisition System (Java SE)	HTTP	Yes	8.1	Network	High	None	None	Un- changed	High	High	High	11.3.2
CVE-2021-20190	Oracle Commerce Guided Search / Oracle Commerce Experience Manager	Experience Manage (jackson-databind)	HTTP	Yes	8.1	Network	High	None	None	Un- changed	High	High	High	11.3.2
CVE-2020-2604	Oracle Commerce Guided Search / Oracle Commerce Experience Manager	Tools and Frameworks (Java SE)	HTTP	Yes	8.1	Network	High	None	None	Un- changed	High	High	High	11.3.2
CVE-2020-25649	Oracle Commerce Platform	Dynamo Application Framework (jackson-databind)	HTTP	Yes	8.1	Network	High	None	None	Un- changed	High	High	High	11.2.0, 11.3.0-11.3.2
CVE-2021-26272	Oracle Commerce Merchandising	Experience Manager, Business Control Center (CKEditor)	HTTP	Yes	6.5	Network	Low	None	Required	Un- changed	None	None	High	11.1.0, 11.2.0, 11.3.0-11.3.2
CVE-2021-2462	Oracle Commerce Service Center	Commerce Service Center	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	11.0.0, 11.1.0, 11.2.0, 11.3.0-11.3.2
CVE-2021-2345	Oracle Commerce Guided Search / Oracle Commerce Experience Manager	Tools and Frameworks	HTTP	No	5.4	Network	Low	Low	Required	Changed	Low	Low	None	11.3.1.5
CVE-2021-2346	Oracle Commerce Guided Search / Oracle Commerce Experience Manager	Tools and Frameworks	HTTP	No	5.4	Network	Low	Low	Required	Changed	Low	Low	None	11.3.1.5
CVE-2021-2348	Oracle Commerce Guided Search / Oracle Commerce Experience Manager	Tools and Frameworks	HTTP	No	4.3	Network	Low	Low	None	Un- changed	Low	None	None	11.3.1.5

Additional CVEs addressed are:

The patch for CVE-2020-25649 also addresses CVE-2020-36189.

Oracle Communications Applications Risk Matrix

This Critical Patch Update contains 33 new security patches for Oracle Communications Applications. 22 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2021-21345	Oracle Communications BRM – Elastic Charging Engine	CN ECE (XStream)	HTTP	No	9.9	Network	Low	Low	None	Changed	High	High	High	12.0.0.3.0
CVE-2021-21345	Oracle Communications Unified Inventory Management	Drools Ruleset (XStream)	HTTP	No	9.9	Network	Low	Low	None	Changed	High	High	High	7.3.2, 7.3.4, 7.3.5, 7.4.0, 7.4.1
CVE-2020-11612	Oracle Communications BRM – Elastic Charging Engine	HTTP GW (Netty)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.0.0.3.0
CVE-2021-3177	Oracle Communications Offline Mediation Controller	UDC CORE (Python)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.0.0.3.0
CVE-2020-17530	Oracle Communications Pricing Design Center	CNE (Apache Struts)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.0.0.3.0
CVE-2019-17195	Oracle Communications Pricing Design Center	CNE (Nimbus JOSE+JWT)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.0.0.3.0
CVE-2021-22112	Oracle Communications Unified Inventory Management	REST API (Spring Security)	HTTP	No	8.8	Network	Low	Low	None	Un- changed	High	High	High	7.4.1
CVE-2020-10878	Oracle Communications Offline Mediation Controller	UDC CORE (Perl)	TCP/IP	Yes	8.6	Network	Low	None	None	Un- changed	Low	Low	High	12.0.0.3.0
CVE-2020-10878	Oracle Communications Pricing Design Center	Transformation for PDC (Perl)	HTTP	Yes	8.6	Network	Low	None	None	Un- changed	Low	Low	High	12.0.0.3.0
CVE-2020-14195	Oracle Communications Instant Messaging Server	Managing Messages (jackson-databind)	HTTP	Yes	8.1	Network	High	None	None	Un- changed	High	High	High	10.0.1.4.0
CVE-2021-3345	Oracle Communications Billing and Revenue Management	Accounts Receivable (libgcrypt)	None	No	7.8	Local	Low	Low	None	Un- changed	High	High	High	12.0.0.3.0
CVE-2020-27216	Oracle Communications Offline Mediation Controller	CN OCOMC (Eclipse Jetty)	None	No	7.8	Local	Low	Low	None	Un- changed	High	High	High	12.0.0.3.0
CVE-2020-27216	Oracle Communications Pricing Design Center	Transformation for PDC (Eclipse Jetty)	None	No	7.8	Local	Low	Low	None	Un- changed	High	High	High	12.0.0.3.0
CVE-2020-8286	Oracle Communications Billing and Revenue Management	Balances (cURL)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	12.0.0.3.0
CVE-2020-25649	Oracle Communications Billing and Revenue Management	Business Operation Center (jackson-databind)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	7.5.0.23.0, 12.0.0.3.0
CVE-2020-25649	Oracle Communications Convergent Charging Controller	Common fns (jackson-databind)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	12.0.4.0.0
CVE-2020-25649	Oracle Communications Network Charging and Control	OUI (jackson-databind)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	12.0.4.0.0
CVE-2019-17566	Oracle Communications Offline Mediation Controller	CN OCOMC (Apache Batik)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	12.0.0.3.0
CVE-2020-28196	Oracle Communications Offline Mediation Controller	NM Core (Kerberos)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	12.0.0.3.0
CVE-2020-5258	Oracle Communications Pricing Design Center	Server for PDC (dojo)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	12.0.0.3.0
CVE-2020-17527	Oracle Communications Pricing Design Center	Transformation for PDC (Apache Tomcat)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	High	None	None	12.0.0.3.0
CVE-2020-28196	Oracle Communications Pricing Design Center	Transformation for PDC (Kerberos)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	12.0.0.3.0
CVE-2020-25648	Oracle Communications Pricing Design Center	CNE (NSS)	HTTPS	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	12.0.0.3.0
CVE-2020-25649	Oracle Communications Unified Inventory Management	Media Resource (jackson-databind)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	7.4.1
CVE-2020-8203	Oracle Communications Billing and Revenue Management	Billing Care (Lodash)	HTTP	Yes	7.4	Network	High	None	None	Un- changed	None	High	High	7.5.0.23.0, 12.0.0.3.0
CVE-2019-10086	Oracle Communications Pricing Design Center	Transformation for PDC (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	12.0.0.3.0
CVE-2020-9484	Oracle Communications Instant Messaging Server	Managing Messages (Apache Tomcat)	None	No	7.0	Local	High	Low	None	Un- changed	High	High	High	10.0.1.4.0
CVE-2020-7017	Oracle Communications Billing and Revenue Management	Balance Monitoring Manager (Kibana)	HTTP	No	6.7	Network	High	Low	Required	Un- changed	High	High	Low	12.0.0.3.0
CVE-2019-3740	Oracle Communications Unified Inventory Management	Inventory Organizer (BSAFE Crypto-J)	HTTP	Yes	6.5	Network	Low	None	Required	Un- changed	High	None	None	7.3.2, 7.3.4, 7.3.5, 7.4.0, 7.4.1
CVE-2020-17521	Oracle Communications BRM – Elastic Charging Engine	Elastic charging controller (Apache Groovy)	None	No	5.5	Local	Low	Low	None	Un- changed	High	None	None	11.3.0.9.0, 12.0.0.3.0
CVE-2021-21290	Oracle Communications Design Studio	Modeling (Netty)	None	No	5.5	Local	Low	Low	None	Un- changed	High	None	None	7.4.2
CVE-2021-20227	Oracle Communications Network Charging and Control	Common fns (SQLite)	None	No	5.5	Local	Low	Low	None	Un- changed	None	None	High	6.0.1.0, 12.0.1.0-12.0.4.0
CVE-2020-11987	Oracle Communications Offline Mediation Controller	UDC CORE (Apache Batik)	TCP/IP	Yes	5.3	Network	Low	None	None	Un- changed	None	Low	None	12.0.0.3.0

Additional CVEs addressed are:

The patch for CVE-2019-3740 also addresses CVE-2019-3738 and CVE-2019-3739.
The patch for CVE-2020-10878 also addresses CVE-2020-10543 and CVE-2020-12723.
The patch for CVE-2020-11612 also addresses CVE-2021-21290.
The patch for CVE-2020-14195 also addresses CVE-2020-14060, CVE-2020-14061 and CVE-2020-14062.
The patch for CVE-2020-25649 also addresses CVE-2020-24616, CVE-2020-24750, CVE-2020-35490, CVE-2020-35491, CVE-2020-35728, CVE-2020-36179, CVE-2020-36180, CVE-2020-36181, CVE-2020-36182, CVE-2020-36183, CVE-2020-36184, CVE-2020-36185, CVE-2020-36186, CVE-2020-36187, CVE-2020-36188 and CVE-2020-36189.
The patch for CVE-2020-27216 also addresses CVE-2020-27218.
The patch for CVE-2020-7017 also addresses CVE-2020-7016.
The patch for CVE-2020-8286 also addresses CVE-2020-8284 and CVE-2020-8285.
The patch for CVE-2021-21345 also addresses CVE-2021-21341, CVE-2021-21342, CVE-2021-21343, CVE-2021-21344, CVE-2021-21346, CVE-2021-21347, CVE-2021-21348, CVE-2021-21349, CVE-2021-21350 and CVE-2021-21351.
The patch for CVE-2021-3177 also addresses CVE-2021-23336.

Oracle Communications Risk Matrix

This Critical Patch Update contains 26 new security patches for Oracle Communications. 23 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2019-17195	Oracle Communications Cloud Native Core Security Edge Protection Proxy	Configuration (Nimbus JOSE+JWT)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	1.7.0
CVE-2020-11612	Oracle Communications Cloud Native Core Service Communication Proxy	KPI (Netty)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	1.5.2
CVE-2020-11998	Oracle Communications Diameter Signaling Router (DSR)	Provisioning (Apache ActiveMQ)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	8.0.0-8.5.0
CVE-2019-12260	Oracle Communications EAGLE Software	Measurements (VxWorks)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	46.6.0-46.8.2
CVE-2020-10878	Oracle SD-WAN Aware	Monitoring (Perl)	HTTP	Yes	8.6	Network	Low	None	None	Un- changed	Low	Low	High	8.2, 9.0
CVE-2020-10543	Oracle SD-WAN Edge	Publications (Perl)	HTTP	Yes	8.6	Network	Low	None	None	Un- changed	Low	Low	High	8.2, 9.0, 9.1
CVE-2020-27216	Oracle Communications Services Gatekeeper	Call Control Common Service (Eclipse Jetty)	None	No	7.8	Local	Low	Low	None	Un- changed	High	High	High	7.0
CVE-2020-5258	Oracle Communications Application Session Controller	Signaling (dojo)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	3.9
CVE-2019-10746	Oracle Communications Cloud Native Core Network Function Cloud Native Environment	Configuration (Kibana)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	1.4.0
CVE-2020-7733	Oracle Communications Cloud Native Core Network Function Cloud Native Environment	Signaling (Kibana)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	1.7.0
CVE-2017-9735	Oracle Communications Cloud Native Core Policy	Configuration (Jetty)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	High	None	None	1.5.0
CVE-2020-5398	Oracle Communications Cloud Native Core Policy	Configuration (Spring Framework)	HTTP	Yes	7.5	Network	High	None	Required	Un- changed	High	High	High	1.5.0
CVE-2019-12399	Oracle Communications Cloud Native Core Policy	Measurements (Apache Kafka)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	High	None	None	1.9.0
CVE-2020-25649	Oracle Communications Cloud Native Core Unified Data Repository	UDR (jackson-databind)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	1.4.0
CVE-2020-25649	Oracle Communications Evolved Communications Application Server	Session Design Center GUI (jackson-databind)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	7.1
CVE-2020-25649	Oracle Communications Services Gatekeeper	OCSG Policy service (jackson-databind)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	7.0
CVE-2019-10086	Oracle Communications Cloud Native Core Console	Signaling (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	1.4.0
CVE-2019-10086	Oracle Communications Cloud Native Core Policy	Measurements (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	1.9.0
CVE-2019-10086	Oracle Communications Cloud Native Core Unified Data Repository	Measurements (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	1.6.0
CVE-2019-10086	Oracle Communications Evolved Communications Application Server	Managing and Using Subscriber Data (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	7.1
CVE-2018-15686	Oracle Communications Cloud Native Core Network Function Cloud Native Environment	Signaling (Calico)	None	No	6.3	Local	High	High	Required	Un- changed	High	High	High	1.4.0
CVE-2020-24553	Oracle Communications Cloud Native Core Policy	Signaling (Go)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	1.5.0
CVE-2020-17521	Oracle Communications Evolved Communications Application Server	Control Engine (Apache Groovy)	None	No	5.5	Local	Low	Low	None	Un- changed	High	None	None	7.1
CVE-2020-29582	Oracle Communications Cloud Native Core Network Slice Selection Function	Signaling (Calico)	HTTP	Yes	5.3	Network	Low	None	None	Un- changed	Low	None	None	1.2.1
CVE-2020-27218	Oracle Communications Services Gatekeeper	Subscriber profile (Eclipse Jetty)	HTTP	Yes	4.8	Network	High	None	None	Un- changed	None	Low	Low	7.0
CVE-2016-0762	Oracle Communications Diameter Signaling Router (DSR)	Provisioning (Apache Tomcat)	HTTP	Yes	4.3	Network	Low	None	Required	Un- changed	None	Low	None	8.0.0-8.5.0

Additional CVEs addressed are:

The patch for CVE-2016-0762 also addresses CVE-2021-30369, CVE-2021-30640 and CVE-2021-33037.
The patch for CVE-2017-9735 also addresses CVE-2017-7656, CVE-2017-7657 and CVE-2017-7658.
The patch for CVE-2019-10746 also addresses CVE-2019-15604, CVE-2019-15605 and CVE-2019-15606.
The patch for CVE-2020-10543 also addresses CVE-2020-10878 and CVE-2020-12723.
The patch for CVE-2020-10878 also addresses CVE-2020-10543 and CVE-2020-12723.
The patch for CVE-2020-25649 also addresses CVE-2020-24616, CVE-2020-24750, CVE-2020-35490, CVE-2020-35491, CVE-2020-35728, CVE-2020-36179, CVE-2020-36180, CVE-2020-36181, CVE-2020-36182, CVE-2020-36183, CVE-2020-36184, CVE-2020-36185, CVE-2020-36186, CVE-2020-36187, CVE-2020-36188 and CVE-2020-36189.
The patch for CVE-2020-27218 also addresses CVE-2020-27216.
The patch for CVE-2020-29582 also addresses CVE-2019-0205, CVE-2019-0210, CVE-2019-16942, CVE-2019-16943, CVE-2019-17531, CVE-2019-20330, CVE-2020-13949, CVE-2020-28052, CVE-2020-8554, CVE-2020-8908 and CVE-2021-21275.
The patch for CVE-2020-7733 also addresses CVE-2020-7016 and CVE-2020-7017.

Oracle Construction and Engineering Risk Matrix

This Critical Patch Update contains 10 new security patches for Oracle Construction and Engineering. 5 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2019-17195	Primavera Gateway	Admin (Nimbus JOSE+JWT)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	18.8.0-18.8.11
CVE-2021-25122	Instantis EnterpriseTrack	HTTP Server (Apache Tomcat)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	High	None	None	17.1, 17.2, 17.3
CVE-2020-25649	Primavera Gateway	Admin (jackson-databind)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	17.12.0-17.12.11, 18.8.0-18.8.11, 19.12.0-19.12.10, 20.12.0
CVE-2020-8203	Primavera Gateway	Admin (Lodash)	HTTP	Yes	7.4	Network	High	None	None	Un- changed	None	High	High	17.12.0-17.12.11, 18.8.0-18.8.11, 19.12.0-19.12.10, 20.12.0
CVE-2021-2366	Primavera P6 Enterprise Project Portfolio Management	Web Access	HTTP	No	6.4	Network	Low	Low	None	Changed	Low	Low	None	17.12.0-17.12.20, 18.8.0-18.8.23, 19.12.0-19.12.14, 20.12.0-20.12.3
CVE-2021-21409	Primavera Gateway	Admin (Netty)	HTTP	Yes	5.9	Network	High	None	None	Un- changed	None	High	None	17.12.0-17.12.11, 18.8.0-18.8.11, 19.12.0-19.12.10
CVE-2021-27906	Primavera Unifier	Core (Apache PDFbox)	None	No	5.5	Local	Low	None	Required	Un- changed	None	None	High	17.7-17.12, 18.8, 19.12, 20.12
CVE-2021-2386	Primavera P6 Enterprise Project Portfolio Management	Web Access	HTTP	No	4.3	Network	Low	Low	None	Un- changed	Low	None	None	20.12.0-20.12.3
CVE-2020-5258	Primavera Unifier	Core UI (dojo)	HTTP	No	4.3	Network	Low	Low	None	Un- changed	None	Low	None	17.7-17.12, 18.8, 19.12, 20.12
CVE-2020-25649	Primavera Unifier	Project Delivery (jackson-databind)	None	No	3.9	Local	Low	Low	Required	Un- changed	Low	Low	None	17.7-17.12, 18.8, 19.12, 20.12

Additional CVEs addressed are:

The patch for CVE-2020-25649 also addresses CVE-2020-36189.
The patch for CVE-2021-21409 also addresses CVE-2021-21290.
The patch for CVE-2021-25122 also addresses CVE-2021-25329.
The patch for CVE-2021-27906 also addresses CVE-2021-27807 and CVE-2021-31811.

Oracle E-Business Suite Risk Matrix

This Critical Patch Update contains 17 new security patches for Oracle E-Business Suite. 3 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

Oracle E-Business Suite products include Oracle Database and Oracle Fusion Middleware components that are affected by the vulnerabilities listed in the Oracle Database and Oracle Fusion Middleware sections. The exposure of Oracle E-Business Suite products is dependent on the Oracle Database and Oracle Fusion Middleware versions being used. Oracle Database and Oracle Fusion Middleware security updates are not listed in the Oracle E-Business Suite risk matrix. However, since vulnerabilities affecting Oracle Database and Oracle Fusion Middleware versions may affect Oracle E-Business Suite products, Oracle recommends that customers apply the July 2021 Critical Patch Update to the Oracle Database and Oracle Fusion Middleware components of Oracle E-Business Suite. For information on what patches need to be applied to your environments, refer to Oracle E-Business Suite Release 12 Critical Patch Update Knowledge Document (July 2021), My Oracle Support Note 2770321.1.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2021-2355	Oracle Marketing	Marketing Administration	HTTP	Yes	9.1	Network	Low	None	None	Un- changed	High	High	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2436	Oracle Common Applications	CRM User Management Framework	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2359	Oracle Marketing	Marketing Administration	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2361	Oracle Advanced Inbound Telephony	SDK client integration	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2398	Oracle Advanced Outbound Telephony	Region Mapping	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2360	Oracle Approvals Management	AME Page rendering	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3
CVE-2021-2406	Oracle Collaborative Planning	User Interface	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3
CVE-2021-2393	Oracle E-Records	E-signatures	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2405	Oracle Engineering	Change Management	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.2.3-12.2.10
CVE-2021-2362	Oracle Field Service	Wireless	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3
CVE-2021-2365	Oracle Human Resources	People Management	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3
CVE-2021-2364	Oracle iSupplier Portal	Accounts	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2363	Oracle Public Sector Financials (International)	Authorization	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3
CVE-2021-2415	Oracle Time and Labor	Timecard	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2434	Oracle Web Applications Desktop Integrator	Application Service	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.3, 12.2.3-12.2.10
CVE-2021-2380	Oracle Applications Framework	Attachments / File Upload	HTTP	No	7.6	Network	Low	Low	Required	Changed	High	Low	None	12.1.3, 12.2.3-12.2.10
CVE-2021-2343	Oracle Workflow	Workflow Notification Mailer	HTTP	No	4.3	Network	Low	Low	None	Un- changed	Low	None	None	12.1.3, 12.2.3-12.2.10

Oracle Enterprise Manager Risk Matrix

This Critical Patch Update contains 8 new security patches for Oracle Enterprise Manager. All of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. None of these patches are applicable to client-only installations, i.e., installations that do not have Oracle Enterprise Manager installed. The English text form of this Risk Matrix can be found here.

Oracle Enterprise Manager products include Oracle Database and Oracle Fusion Middleware components that are affected by the vulnerabilities listed in the Oracle Database and Oracle Fusion Middleware sections. The exposure of Oracle Enterprise Manager products is dependent on the Oracle Database and Oracle Fusion Middleware versions being used. Oracle Database and Oracle Fusion Middleware security updates are not listed in the Oracle Enterprise Manager risk matrix. However, since vulnerabilities affecting Oracle Database and Oracle Fusion Middleware versions may affect Oracle Enterprise Manager products, Oracle recommends that customers apply the July 2021 Critical Patch Update to the Oracle Database and Oracle Fusion Middleware components of Enterprise Manager. For information on what patches need to be applied to your environments, refer to Critical Patch Update July 2021 Patch Availability Document for Oracle Products, My Oracle Support Note 2773670.1.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-10683	Enterprise Manager Base Platform	Application Service Level Mgmt (dom4j)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	13.4.0.0
CVE-2019-5064	Enterprise Manager Base Platform	Application Service Level Mgmt (OpenCV)	HTTP	Yes	8.8	Network	Low	None	Required	Un- changed	High	High	High	13.4.0.0
CVE-2020-10878	Oracle Configuration Manager	Content Server (Perl)	HTTP	Yes	8.6	Network	Low	None	None	Un- changed	Low	Low	High	12.1.2.0.8
CVE-2020-1971	Enterprise Manager Base Platform	Discovery Framework (OpenSSL)	HTTPS	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	13.4.0.0
CVE-2019-2897	Enterprise Manager Base Platform	Enterprise Config Management	HTTP	Yes	7.4	Network	High	None	None	Un- changed	High	High	None	13.4.0.0
CVE-2019-2897	Enterprise Manager Base Platform	System Monitoring	HTTP	Yes	7.4	Network	High	None	None	Un- changed	High	High	None	13.4.0.0
CVE-2019-10086	Oracle Application Testing Suite	Load Testing for Web Apps (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	13.3.0.1
CVE-2017-14735	Enterprise Manager Base Platform	UI Framework (AntiSamy)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	13.4.0.0

Additional CVEs addressed are:

The patch for CVE-2019-5064 also addresses CVE-2019-5063.
The patch for CVE-2020-10878 also addresses CVE-2020-10543 and CVE-2020-12723.
The patch for CVE-2020-1971 also addresses CVE-2020-1967.

Oracle Financial Services Applications Risk Matrix

This Critical Patch Update contains 22 new security patches for Oracle Financial Services Applications. 17 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2021-21345	Oracle Banking Enterprise Default Management	Collections (XStream)	HTTP	No	9.9	Network	Low	Low	None	Changed	High	High	High	2.10.0, 2.12.0
CVE-2021-21345	Oracle Banking Platform	Collections (XStream)	HTTP	No	9.9	Network	Low	Low	None	Changed	High	High	High	2.4.0, 2.7.1, 2.9.0, 2.12.0
CVE-2019-0228	Oracle Banking Liquidity Management	Onboarding (Apache PDFbox)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	14.2, 14.3, 14.5
CVE-2021-26117	Oracle FLEXCUBE Private Banking	Financial Planning (Apache ActiveMQ)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.0.0, 12.1.0
CVE-2020-5413	Oracle FLEXCUBE Private Banking	Financial Planning (Spring Integration)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.0.0, 12.1.0
CVE-2020-11998	Oracle FLEXCUBE Private Banking	Financial Planning (Apache ActiveMQ)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.0.0, 12.1.0
CVE-2020-27218	Oracle FLEXCUBE Private Banking	Financial Planning (Eclipse Jetty)	HTTP	Yes	9.4	Network	Low	None	None	Un- changed	High	High	Low	12.0.0, 12.1.0
CVE-2020-24750	Oracle Banking Liquidity Management	Onboarding (jackson-databind)	HTTP	Yes	8.1	Network	High	None	None	Un- changed	High	High	High	14.2,14.3, 14.5
CVE-2020-25649	Oracle Banking Treasury Management	Accounting (jackson-databind)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	14.4
CVE-2020-11979	Oracle Banking Treasury Management	Capital Workflow (Apache Ant)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	14.4
CVE-2020-11979	Oracle Financial Services Analytical Applications Infrastructure	Rate Management (Apache Ant)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	8.0.6-8.0.9, 8.1.0, 8.1.1
CVE-2020-11979	Oracle FLEXCUBE Private Banking	Order Management (Apache Ant)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	12.0.0, 12.1.0
CVE-2020-8203	Oracle Banking Liquidity Management	DashBoard (Lodash)	HTTP	Yes	7.4	Network	High	None	None	Un- changed	None	High	High	14.2,14.3, 14.5
CVE-2019-10086	Oracle Financial Services Revenue Management and Billing Analytics	Dashboards (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	2.7.0, 2.8.0
CVE-2020-7712	Oracle Financial Services Regulatory Reporting with AgileREPORTER	Reports (Apache ZooKeeper)	HTTP	No	7.2	Network	Low	High	None	Un- changed	High	High	High	8.0.9.6.3
CVE-2020-27193	Oracle Banking Party Management	Web UI (CKEditor)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	2.7.0
CVE-2020-27193	Oracle Financial Services Analytical Applications Infrastructure	Rate Management (CKEditor)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.0.6-8.0.9, 8.1.0, 8.1.1
CVE-2020-11022	Oracle Financial Services Revenue Management and Billing Analytics	Dashboards (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	2.7.0, 2.8.0
CVE-2021-2323	Oracle FLEXCUBE Universal Banking	Flex-Branch	HTTP	Yes	5.9	Network	High	None	None	Un- changed	High	None	None	12.3,12.4, 14.0-14.4,
CVE-2020-11987	Oracle FLEXCUBE Universal Banking	General Ledger (Apache Batik)	HTTP	Yes	5.3	Network	Low	None	None	Un- changed	None	Low	None	14.1.0-14.4.0
CVE-2021-2324	Oracle FLEXCUBE Universal Banking	Loans And Deposits	HTTP	No	4.6	Network	Low	Low	Required	Un- changed	Low	Low	None	12.0-12.4, 14.0-14.4,
CVE-2021-2448	Oracle Financial Services Crime and Compliance Investigation Hub	Reports	None	No	3.7	Local	High	High	Required	Changed	Low	Low	None	20.1.2

Additional CVEs addressed are:

The patch for CVE-2020-11022 also addresses CVE-2020-11023.
The patch for CVE-2020-11998 also addresses CVE-2020-11973 and CVE-2020-1941.
The patch for CVE-2020-24750 also addresses CVE-2020-24616.
The patch for CVE-2020-25649 also addresses CVE-2020-35490, CVE-2020-35491, CVE-2020-35728, CVE-2020-36179, CVE-2020-36180, CVE-2020-36181, CVE-2020-36182, CVE-2020-36183, CVE-2020-36184, CVE-2020-36185, CVE-2020-36186, CVE-2020-36187, CVE-2020-36188 and CVE-2020-36189.
The patch for CVE-2020-27193 also addresses CVE-2021-26271 and CVE-2021-26272.
The patch for CVE-2020-27218 also addresses CVE-2020-27216.
The patch for CVE-2020-5413 also addresses CVE-2019-10086 and CVE-2020-9489.
The patch for CVE-2021-21345 also addresses CVE-2021-21341, CVE-2021-21342, CVE-2021-21343, CVE-2021-21344, CVE-2021-21346, CVE-2021-21347, CVE-2021-21348, CVE-2021-21349, CVE-2021-21350 and CVE-2021-21351.
The patch for CVE-2021-26117 also addresses CVE-2020-11973 and CVE-2020-1941.

Oracle Food and Beverage Applications Risk Matrix

This Critical Patch Update contains 6 new security patches for Oracle Food and Beverage Applications. None of these vulnerabilities may be remotely exploitable without authentication, i.e., none may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2021-2395	Oracle Hospitality Reporting and Analytics	iCare, Configuration	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	9.1.0
CVE-2021-3156	MICROS Compact Workstation 3	Workstation 310 (Sudo)	None	No	7.8	Local	Low	Low	None	Un- changed	High	High	High	310
CVE-2021-3156	MICROS ES400 Series	Express Station 4 (Sudo)	None	No	7.8	Local	Low	Low	None	Un- changed	High	High	High	400-410
CVE-2021-3156	MICROS Kitchen Display System Hardware	Kitchen Display System 210 (Sudo)	None	No	7.8	Local	Low	Low	None	Un- changed	High	High	High	210
CVE-2021-3156	MICROS Workstation 5A	Workstation 5A (Sudo)	None	No	7.8	Local	Low	Low	None	Un- changed	High	High	High	5A
CVE-2021-3156	MICROS Workstation 6	Workstation 6 (Sudo)	None	No	7.8	Local	Low	Low	None	Un- changed	High	High	High	610-655

Oracle Fusion Middleware Risk Matrix

This Critical Patch Update contains 48 new security patches for Oracle Fusion Middleware. 35 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

Oracle Fusion Middleware products include Oracle Database components that are affected by the vulnerabilities listed in the Oracle Database section. The exposure of Oracle Fusion Middleware products is dependent on the Oracle Database version being used. Oracle Database security updates are not listed in the Oracle Fusion Middleware risk matrix. However, since vulnerabilities affecting Oracle Database versions may affect Oracle Fusion Middleware products, Oracle recommends that customers apply the Critical Patch Update July 2021 to the Oracle Database components of Oracle Fusion Middleware products. For information on what patches need to be applied to your environments, refer to Critical Patch Update July 2021 Patch Availability Document for Oracle Products, My Oracle Support Note 2773670.1.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2021-21345	Oracle BAM (Business Activity Monitoring)	General (XStream)	HTTP	No	9.9	Network	Low	Low	None	Changed	High	High	High	11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2021-21345	Oracle WebCenter Portal	Security Framework (XStream)	HTTP	No	9.9	Network	Low	Low	None	Changed	High	High	High	11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2021-2456	Oracle Business Intelligence Enterprise Edition	Analytics Web General	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.2.1.4.0
CVE-2019-17195	Oracle Data Integrator	Runtime Java agent for ODI (Nimbus JOSE+JWT)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.2.1.4.0
CVE-2020-10683	Oracle JDeveloper	Oracle JDeveloper (dom4j)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.2.1.4.0
CVE-2020-28052	Oracle WebCenter Portal	Security Framework (Bouncy Castle Java Library)	HTTPS	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2021-2394	Oracle WebLogic Server	Core	T3, IIOP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
CVE-2021-2397	Oracle WebLogic Server	Core	T3, IIOP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
CVE-2021-2382	Oracle WebLogic Server	Security	T3, IIOP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
CVE-2021-2392	Oracle BI Publisher	BI Publisher Security	HTTP	No	8.8	Network	Low	Low	None	Un- changed	High	High	High	5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2021-2396	Oracle BI Publisher	E-Business Suite – XDO	HTTP	No	8.8	Network	Low	Low	None	Un- changed	High	High	High	5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2021-2391	Oracle BI Publisher	Scheduler	HTTP	No	8.8	Network	Low	Low	None	Un- changed	High	High	High	5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2020-5421	Oracle Enterprise Data Quality	General (Spring Framework)	HTTP	No	8.8	Network	Low	Low	None	Un- changed	High	High	High	12.2.1.3.0, 12.2.1.4.0
CVE-2021-2428	Oracle Coherence	Core	T3, IIOP	Yes	8.1	Network	High	None	None	Un- changed	High	High	High	12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
CVE-2021-2458	Identity Manager	Identity Console	HTTP	No	7.6	Network	Low	Low	Required	Changed	High	Low	None	11.1.2.2.0, 11.1.2.3.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2021-2400	Oracle BI Publisher	E-Business Suite – XDO	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	High	None	None	5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2021-2371	Oracle Coherence	Core	T3, IIOP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
CVE-2021-2344	Oracle Coherence	Core	T3, IIOP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
CVE-2020-25649	Oracle GoldenGate Application Adapters	Application Adapters (jackson-databind)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	19.1.0.0.0
CVE-2019-12402	Oracle JDeveloper	Oracle JDeveloper (Apache Commons Compress)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	12.2.1.4.0
CVE-2021-25122	Oracle Managed File Transfer	MFT Runtime Server (Apache Tomcat)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	High	None	None	12.2.1.3.0, 12.2.1.4.0
CVE-2021-2378	Oracle WebLogic Server	Core	T3, IIOP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
CVE-2021-2376	Oracle WebLogic Server	Web Services	T3, IIOP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
CVE-2015-0254	Oracle WebLogic Server	Third Party Tools (Apache Standard Taglibs)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	10.3.6.0.0, 12.1.3.0.0
CVE-2019-10086	Real-Time Decisions (RTD) Solutions	WLS Deployment Template for RT (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	3.2.0.0
CVE-2021-2450	Oracle Outside In Technology	Outside In Filters	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	8.5.5	See Note 1
CVE-2021-2451	Oracle Outside In Technology	Outside In Filters	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	8.5.5	See Note 1
CVE-2021-2419	Oracle Outside In Technology	Outside In Filters	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	8.5.5	See Note 1
CVE-2021-2420	Oracle Outside In Technology	Outside In Filters	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	8.5.5	See Note 1
CVE-2021-2423	Oracle Outside In Technology	Outside In Filters	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	8.5.5	See Note 1
CVE-2021-2449	Oracle Outside In Technology	Outside In Filters	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	8.5.5	See Note 1
CVE-2021-2452	Oracle Outside In Technology	Outside In Filters	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	8.5.5	See Note 1
CVE-2021-2430	Oracle Outside In Technology	Outside In Filters	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	8.5.5	See Note 1
CVE-2021-2431	Oracle Outside In Technology	Outside In Filters	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	8.5.5	See Note 1
CVE-2021-2453	Oracle Outside In Technology	Outside In Filters	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	8.5.5	See Note 1
CVE-2020-1945	Oracle Data Integrator	Install, config, upgrade (Apache Ant)	None	No	6.3	Local	High	Low	None	Un- changed	High	High	None	12.2.1.3.0, 12.2.1.4.0
CVE-2019-11358	Identity Manager	UI Platform (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	12.2.1.3.0
CVE-2019-12415	Oracle JDeveloper	OAM (Apache POI)	None	No	5.5	Local	Low	Low	None	Un- changed	High	None	None	12.2.1.4.0
CVE-2021-27906	Oracle Outside In Technology	Outside In Clean Content SDK (Apache PDFBox)	None	No	5.5	Local	Low	None	Required	Un- changed	None	None	High	8.5.5
CVE-2021-2457	Identity Manager	Request Management & Workflow	HTTP	Yes	5.3	Network	Low	None	None	Un- changed	Low	None	None	11.1.2.3.0
CVE-2021-2401	Oracle BI Publisher	E-Business Suite – XDO	HTTP	Yes	5.3	Network	Low	None	None	Un- changed	Low	None	None	5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2020-13956	Oracle Data Integrator	Install, config, upgrade (Apache HttpClient)	HTTP	Yes	5.3	Network	Low	None	None	Un- changed	None	Low	None	12.2.1.3.0, 12.2.1.4.0
CVE-2020-11987	Oracle Enterprise Repository	Security Subsystem – 12c (Apache Batik)	HTTP	Yes	5.3	Network	Low	None	None	Un- changed	None	Low	None	11.1.1.7.0
CVE-2020-11987	Oracle Fusion Middleware MapViewer	Install (Apache Batik)	HTTP	Yes	5.3	Network	Low	None	None	Un- changed	None	Low	None	12.2.1.4.0
CVE-2021-2403	Oracle WebLogic Server	Core	HTTP	Yes	5.3	Network	Low	None	None	Un- changed	Low	None	None	10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
CVE-2021-2358	Oracle Access Manager	Rest interfaces for Access Mgr	HTTPS	No	4.9	Network	Low	High	None	Un- changed	High	None	None	11.1.2.3.0
CVE-2020-8908	Oracle Data Integrator	Install, config, upgrade (Guava)	None	No	3.3	Local	Low	Low	None	Un- changed	Low	None	None	12.2.1.3.0, 12.2.1.4.0
CVE-2020-2555	Oracle Access Manager	Installation Component (Oracle Coherence)	HTTPS	No	3.1	Adjacent Network	High	High	None	Un- changed	Low	Low	None	11.1.2.3.0

Notes:

Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS Base Score depend on the software that uses Outside In Technology. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology, but if data is not received over a network the CVSS score may be lower.

Additional CVEs addressed are:

The patch for CVE-2020-1945 also addresses CVE-2020-11979.
The patch for CVE-2020-5421 also addresses CVE-2021-22118.
The patch for CVE-2021-21345 also addresses CVE-2019-10173, CVE-2021-21341, CVE-2021-21342, CVE-2021-21343, CVE-2021-21344, CVE-2021-21346, CVE-2021-21347, CVE-2021-21348, CVE-2021-21349, CVE-2021-21350 and CVE-2021-21351.
The patch for CVE-2021-2397 also addresses CVE-2020-14756.
The patch for CVE-2021-25122 also addresses CVE-2021-25329.
The patch for CVE-2021-27906 also addresses CVE-2021-27807.

Oracle Hospitality Applications Risk Matrix

This Critical Patch Update contains 1 new security patch for Oracle Hospitality Applications. This vulnerability is not remotely exploitable without authentication, i.e., may not be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2021-21290	Oracle Hospitality Suite8	Spa and Leisure (Netty)	None	No	5.5	Local	Low	Low	None	Un- changed	High	None	None	8.13, 8.14

Oracle Hyperion Risk Matrix

This Critical Patch Update contains 6 new security patches for Oracle Hyperion. 4 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2019-2729	Hyperion Infrastructure Technology	Installation and Configuration (Oracle WebLogic Server)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	11.1.2.4, 11.2.5.0
CVE-2019-17566	Hyperion Financial Reporting	Installation (Apache Batik)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	11.1.2.4, 11.2.5.0
CVE-2017-14735	Hyperion Infrastructure Technology	Common Security (AntiSamy)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	11.1.2.4, 11.2.5.0
CVE-2021-2445	Hyperion Infrastructure Technology	Lifecycle Management	HTTP	No	5.7	Network	High	High	Required	Un- changed	High	High	None	11.2.5.0
CVE-2021-2347	Hyperion Infrastructure Technology	Lifecycle Management	HTTP	No	5.2	Network	Low	High	Required	Un- changed	High	Low	None	11.2.5.0
CVE-2021-2439	Oracle Hyperion BI+	UI and Visualization	HTTP	Yes	4.3	Network	Low	None	Required	Un- changed	Low	None	None	11.1.2.4, 11.2.5.0

Additional CVEs addressed are:

The patch for CVE-2019-2729 also addresses CVE-2019-2725.

Oracle Insurance Applications Risk Matrix

This Critical Patch Update contains 4 new security patches for Oracle Insurance Applications. 3 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2021-22112	Oracle Insurance Policy Administration	Architecture (Spring Security)	HTTP	No	8.8	Network	Low	Low	None	Un- changed	High	High	High	11.2.0, 11.3.0
CVE-2020-35490	Oracle Insurance Policy Administration J2EE	Security Information (jackson-databind)	HTTP	Yes	8.1	Network	High	None	None	Un- changed	High	High	High	11.0.2
CVE-2020-25649	Oracle Insurance Policy Administration	Architecture (jackson-databind)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	11.0.2, 11.1.0-11.3.0
CVE-2020-25649	Oracle Insurance Rules Palette	Architecture (jackson-databind)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	11.0.2, 11.1.0-11.3.0

Additional CVEs addressed are:

The patch for CVE-2020-35490 also addresses CVE-2020-35491.

Oracle Java SE Risk Matrix

This Critical Patch Update contains 6 new security patches for Oracle Java SE. 5 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2021-29921	Oracle GraalVM Enterprise Edition	Python interpreter and runtime (CPython)	Multiple	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	Oracle GraalVM Enterprise Edition: 20.3.2, 21.1.0
CVE-2021-2388	Java SE, Oracle GraalVM Enterprise Edition	Hotspot	Multiple	Yes	7.5	Network	High	None	Required	Un- changed	High	High	High	Java SE: 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition: 20.3.2, 21.1.0	See Note 1
CVE-2020-28928	Oracle GraalVM Enterprise Edition	LLVM Interpreter (musl libc)	None	No	5.5	Local	Low	Low	None	Un- changed	None	None	High	Oracle GraalVM Enterprise Edition: 20.3.2, 21.1.0
CVE-2021-2369	Java SE, Oracle GraalVM Enterprise Edition	Library	Multiple	Yes	4.3	Network	Low	None	Required	Un- changed	None	Low	None	Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition: 20.3.2, 21.1.0	See Note 1
CVE-2021-2432	Java SE	JNDI	Multiple	Yes	3.7	Network	High	None	None	Un- changed	None	None	Low	Java SE: 7u301	See Note 2
CVE-2021-2341	Java SE, Oracle GraalVM Enterprise Edition	Networking	Multiple	Yes	3.1	Network	High	None	Required	Un- changed	Low	None	None	Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition: 20.3.2, 21.1.0	See Note 1

Notes:

This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).
This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs.

Oracle JD Edwards Risk Matrix

This Critical Patch Update contains 9 new security patches for Oracle JD Edwards. 8 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2019-13990	JD Edwards EnterpriseOne Orchestrator	E1 IOT Orchestrator Security (Quartz)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	9.2.5.3 and Prior
CVE-2019-17195	JD Edwards EnterpriseOne Orchestrator	E1 IOT Orchestrator Security (Nimbus JOSE+JWT)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	9.2.5.3 and prior
CVE-2019-17195	JD Edwards EnterpriseOne Tools	Business Logic Inf SEC (Nimbus JOSE+JWT)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	9.2.5.3 and prior
CVE-2019-17195	JD Edwards EnterpriseOne Tools	Web Runtime SEC (Nimbus JOSE+JWT)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	9.2.5.3 and prior
CVE-2020-25649	JD Edwards EnterpriseOne Orchestrator	E1 IOT Orchestrator Security (jackson-databind)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	9.2.5.3 and prior
CVE-2020-25649	JD Edwards EnterpriseOne Tools	Monitoring and Diagnostics SEC (jackson-databind)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	9.2.5.3 and prior
CVE-2020-25649	JD Edwards EnterpriseOne Tools	Web Runtime SEC (jackson-databind)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	9.2.5.3 and prior
CVE-2021-2375	JD Edwards EnterpriseOne Tools	Web Runtime	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	9.2.5.3 and prior
CVE-2021-2373	JD Edwards EnterpriseOne Tools	Web Runtime	HTTP	No	5.4	Network	Low	Low	Required	Changed	Low	Low	None	9.2.5.3 and Prior

Additional CVEs addressed are:

The patch for CVE-2020-25649 also addresses CVE-2020-36189.

Oracle MySQL Risk Matrix

This Critical Patch Update contains 41 new security patches for Oracle MySQL. 10 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2021-22884	MySQL Cluster	Cluster: JS module (Node.js)	Multiple	Yes	8.8	Network	Low	None	Required	Un- changed	High	High	High	8.0.25 and prior
CVE-2021-22901	MySQL Server	Server: Packaging (curl)	Multiple	Yes	8.1	Network	High	None	None	Un- changed	High	High	High	5.7.34 and prior, 8.0.25 and prior
CVE-2021-25122	MySQL Enterprise Monitor	Monitoring: General (Apache Tomcat)	HTTPS/2	Yes	7.5	Network	Low	None	None	Un- changed	High	None	None	8.0.23 and prior
CVE-2019-17543	MySQL Server	Server: Compiling (LZ4)	MySQL Protocol	No	7.5	Network	High	Low	None	Un- changed	High	High	High	5.7.34 and prior, 8.0.25 and prior
CVE-2021-3450	MySQL Connectors	Connector/C++ (OpenSSL)	MySQL Protocol	Yes	7.4	Network	High	None	None	Un- changed	High	High	None	8.0.23 and prior
CVE-2021-3450	MySQL Connectors	Connector/ODBC (OpenSSL)	MySQL Protocol	Yes	7.4	Network	High	None	None	Un- changed	High	High	None	8.0.23 and prior
CVE-2021-3450	MySQL Enterprise Monitor	Monitoring: General (OpenSSL)	HTTPS	Yes	7.4	Network	High	None	None	Un- changed	High	High	None	8.0.23 and prior
CVE-2021-2417	MySQL Server	Server: GIS	MySQL Protocol	No	6.0	Network	Low	High	None	Un- changed	Low	Low	High	8.0.25 and prior
CVE-2021-2389	MySQL Server	InnoDB	MySQL Protocol	Yes	5.9	Network	High	None	None	Un- changed	None	None	High	5.7.34 and prior, 8.0.25 and prior
CVE-2021-2390	MySQL Server	InnoDB	MySQL Protocol	Yes	5.9	Network	High	None	None	Un- changed	None	None	High	5.7.34 and prior, 8.0.25 and prior
CVE-2021-2429	MySQL Server	InnoDB	MySQL Protocol	Yes	5.9	Network	High	None	None	Un- changed	None	None	High	8.0.25 and prior
CVE-2021-2356	MySQL Server	Server: Replication	MySQL Protocol	No	5.9	Network	High	Low	None	Un- changed	None	Low	High	5.7.34 and prior, 8.0.25 and prior
CVE-2021-2385	MySQL Server	Server: Replication	MySQL Protocol	No	5.0	Network	High	High	None	Un- changed	None	Low	High	5.7.34 and prior, 8.0.25 and prior
CVE-2021-2339	MySQL Server	Server: DDL	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.25 and prior
CVE-2021-2352	MySQL Server	Server: DDL	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.25 and prior
CVE-2021-2399	MySQL Server	Server: DDL	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.25 and prior
CVE-2021-2370	MySQL Server	Server: DML	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.25 and prior
CVE-2021-2440	MySQL Server	Server: DML	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.25 and prior
CVE-2021-2354	MySQL Server	Server: Federated	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.25 and prior
CVE-2021-2402	MySQL Server	Server: Locking	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.25 and prior
CVE-2021-2342	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	5.7.34 and prior, 8.0.25 and prior
CVE-2021-2357	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.25 and prior
CVE-2021-2367	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.25 and prior
CVE-2021-2412	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.21 and prior
CVE-2021-2383	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.25 and prior
CVE-2021-2384	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.25 and prior
CVE-2021-2387	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.25 and prior
CVE-2021-2444	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.23 and prior
CVE-2021-2410	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.25 and prior
CVE-2021-2418	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.25 and prior
CVE-2021-2425	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.25 and prior
CVE-2021-2426	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.25 and prior
CVE-2021-2427	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.25 and prior
CVE-2021-2437	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.25 and prior
CVE-2021-2441	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.25 and prior
CVE-2021-2422	MySQL Server	Server: PS	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.25 and prior
CVE-2021-2424	MySQL Server	Server: Stored Procedure	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.25 and prior
CVE-2021-2372	MySQL Server	InnoDB	MySQL Protocol	No	4.4	Network	High	High	None	Un- changed	None	None	High	5.7.34 and prior, 8.0.25 and prior
CVE-2021-2374	MySQL Server	InnoDB	None	No	4.1	Local	High	High	None	Un- changed	High	None	None	8.0.25 and prior
CVE-2021-2411	MySQL Cluster	Cluster: JS module	Multiple	Yes	3.7	Network	High	None	None	Un- changed	None	None	Low	8.0.25 and prior
CVE-2021-2340	MySQL Server	Server: Memcached	MySQL Protocol	No	2.7	Network	Low	High	None	Un- changed	None	None	Low	8.0.25 and prior

Additional CVEs addressed are:

The patch for CVE-2021-22884 also addresses CVE-2021-22883 and CVE-2021-23840.
The patch for CVE-2021-22901 also addresses CVE-2021-22897 and CVE-2021-22898.
The patch for CVE-2021-25122 also addresses CVE-2021-25329.
The patch for CVE-2021-3450 also addresses CVE-2021-3449.

Oracle PeopleSoft Risk Matrix

This Critical Patch Update contains 14 new security patches for Oracle PeopleSoft. 8 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2019-17195	PeopleSoft Enterprise PeopleTools	REST Services (Nimbus JOSE+JWT)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	8.58, 8.59
CVE-2021-27568	PeopleSoft Enterprise PeopleTools	REST Services (netplex json-smart-v1)	HTTP	Yes	9.1	Network	Low	None	None	Un- changed	High	None	High	8.58, 8.59
CVE-2021-22884	PeopleSoft Enterprise PeopleTools	Elastic Search (Node.js)	HTTP	Yes	7.5	Network	High	None	Required	Un- changed	High	High	High	8.58, 8.59
CVE-2021-3450	PeopleSoft Enterprise PeopleTools	Security (OpenSSL)	TLS	Yes	7.4	Network	High	None	None	Un- changed	High	High	None	8.57, 8.58. 8.59
CVE-2020-7017	PeopleSoft Enterprise PeopleTools	Elastic Search (Kibana)	HTTP	No	6.7	Network	High	Low	Required	Un- changed	High	High	Low	8.58
CVE-2021-2421	PeopleSoft Enterprise CS Campus Community	Integration and Interfaces	HTTP	No	6.5	Network	Low	Low	None	Un- changed	High	None	None	9.0, 9.2
CVE-2021-2404	PeopleSoft Enterprise HCM Candidate Gateway	e-mail notification	HTTP	Yes	6.5	Network	Low	None	None	Un- changed	Low	Low	None	9.2
CVE-2021-2455	PeopleSoft Enterprise HCM Shared Components	Person Search	HTTP	No	6.5	Network	Low	High	None	Un- changed	High	High	None	9.2
CVE-2021-2408	PeopleSoft Enterprise PT PeopleTools	Notification Configuration	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.59
CVE-2021-21290	PeopleSoft Enterprise PeopleTools	Elastic Search (Netty)	None	No	5.5	Local	Low	Low	None	Un- changed	High	None	None	8.57, 8.58, 8.59
CVE-2021-2407	PeopleSoft Enterprise PeopleTools	Portal	HTTP	Yes	5.3	Network	Low	None	None	Un- changed	Low	None	None	8.57, 8.58, 8.59
CVE-2020-13956	PeopleSoft Enterprise PT PeopleTools	Cloud Manager (Apache HttpClient)	HTTP	Yes	5.3	Network	Low	None	None	Un- changed	None	Low	None	8.57, 8.58, 8.59
CVE-2021-2377	PeopleSoft Enterprise PeopleTools	SQR	HTTP	No	4.3	Network	Low	Low	None	Un- changed	Low	None	None	8.57, 8.58, 8.59
CVE-2020-8908	PeopleSoft Enterprise PeopleTools	Elastic Search (Google Guava)	None	No	3.3	Local	Low	Low	None	Un- changed	Low	None	None	8.57, 8.58, 8.59

Additional CVEs addressed are:

The patch for CVE-2020-7017 also addresses CVE-2020-7016.
The patch for CVE-2021-22884 also addresses CVE-2018-7160 and CVE-2021-22883.
The patch for CVE-2021-3450 also addresses CVE-2021-23839, CVE-2021-23840, CVE-2021-23841 and CVE-2021-3449.

Oracle Policy Automation Risk Matrix

This Critical Patch Update contains 1 new security patch for Oracle Policy Automation. This vulnerability is remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2019-17195	Oracle Policy Automation	Hub (Nimbus JOSE+JWT)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.2.0-12.2.22

Oracle Retail Applications Risk Matrix

This Critical Patch Update contains 23 new security patches for Oracle Retail Applications. 15 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2021-21345	Oracle Retail Xstore Point of Service	Xenvironment (XStream)	HTTP	No	9.9	Network	Low	Low	None	Changed	High	High	High	16.0.6, 17.0.4, 18.0.3, 19.0.2
CVE-2019-0219	Oracle Retail Xstore Point of Service	Xenvironment (Apache cordova-plugin-inappbrowser)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	16.0.6, 17.0.4, 18.0.3, 19.0.2
CVE-2020-5421	Oracle Retail Customer Management and Segmentation Foundation	Promotions (Spring Framework)	HTTP	No	8.8	Network	Low	Low	None	Un- changed	High	High	High	16.0-19.0
CVE-2020-5421	Oracle Retail Merchandising System	Foundation (Spring Framework)	HTTP	No	8.8	Network	Low	Low	None	Un- changed	High	High	High	16.0.3
CVE-2021-22118	Oracle Retail Financial Integration	PeopleSoft Integration Bugs (Spring Framework)	None	No	7.8	Local	Low	Low	None	Un- changed	High	High	High	16.0.3.0, 15.0.3.1, 14.1.3.2
CVE-2021-22118	Oracle Retail Integration Bus	RIB Kernal (Spring Framework)	None	No	7.8	Local	Low	Low	None	Un- changed	High	High	High	16.0.3.0, 15.0.3.1, 14.1.3.2
CVE-2021-22118	Oracle Retail Order Broker	System Administration (Spring Framework)	None	No	7.8	Local	Low	Low	None	Un- changed	High	High	High	16.0
CVE-2020-5398	Oracle Retail Back Office	Pricing (Spring Framework)	HTTP	Yes	7.5	Network	High	None	Required	Un- changed	High	High	High	14.1
CVE-2020-5398	Oracle Retail Central Office	Transaction Tracker (Spring Framework)	HTTP	Yes	7.5	Network	High	None	Required	Un- changed	High	High	High	14.1
CVE-2020-11979	Oracle Retail Merchandising System	Procurement (Apache Ant)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	14.1.3.2
CVE-2020-5398	Oracle Retail Point-of-Service	Queue Management (Spring Framework)	HTTP	Yes	7.5	Network	High	None	Required	Un- changed	High	High	High	14.1
CVE-2020-5398	Oracle Retail Returns Management	Main Dashboard (Spring Framework)	HTTP	Yes	7.5	Network	High	None	Required	Un- changed	High	High	High	14.1
CVE-2020-25649	Oracle Retail Service Backbone	RSB Installation (jackson-databind)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	16.0.3.0, 15.0.3.1, 14.1.3.2
CVE-2020-17527	Oracle Retail Xstore Point of Service	Xenvironment (Apache Tomcat)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	High	None	None	16.0.6, 17.0.4, 18.0.3, 19.0.2, 20.0.1
CVE-2020-8277	Oracle Retail Xstore Point of Service	Xenvironment (Node.js)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	16.0.6, 17.0.4, 18.0.3, 19.0.2, 20.0.1
CVE-2020-25649	Oracle Retail Xstore Point of Service	Xenvironment (jackson-databind)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	16.0.6, 17.0.4, 18.0.3, 19.0.2
CVE-2020-25638	Oracle Retail Customer Management and Segmentation Foundation	Segment (Hibernate)	HTTP	Yes	7.4	Network	High	None	None	Un- changed	High	High	None	19.0
CVE-2019-10086	Oracle Retail Merchandising System	Foundation (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	15.0.3.1
CVE-2019-10086	Oracle Retail Price Management	Manage Allocation (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	14.0, 14.1, 15.0, 16.0
CVE-2020-5421	Oracle Retail Customer Engagement	Internal Operations (Spring Framework)	HTTP	No	6.5	Network	High	Low	Required	Changed	Low	High	None	16.0-19.0
CVE-2021-27807	Oracle Retail Customer Management and Segmentation Foundation	Segment (Apache PDFbox)	HTTP	No	6.5	Network	High	Low	Required	Changed	Low	High	None	19.0
CVE-2020-11987	Oracle Retail Order Broker	Store Connect (Apache Batik)	HTTP	Yes	5.3	Network	Low	None	None	Un- changed	None	Low	None	15.0, 16.0
CVE-2020-11987	Oracle Retail Order Management System Cloud Service	Internal Operations (Apache Batik)	HTTP	Yes	5.3	Network	Low	None	None	Un- changed	None	Low	None	19.5

Additional CVEs addressed are:

The patch for CVE-2020-11987 also addresses CVE-2019-17566.
The patch for CVE-2020-25649 also addresses CVE-2020-35490, CVE-2020-35491, CVE-2020-35728, CVE-2020-36179, CVE-2020-36180, CVE-2020-36181, CVE-2020-36182, CVE-2020-36183, CVE-2020-36184, CVE-2020-36185, CVE-2020-36186, CVE-2020-36187, CVE-2020-36188 and CVE-2020-36189.
The patch for CVE-2020-5398 also addresses CVE-2020-5397 and CVE-2020-5421.
The patch for CVE-2020-5421 also addresses CVE-2020-5413.
The patch for CVE-2020-8277 also addresses CVE-2020-8174.
The patch for CVE-2021-21345 also addresses CVE-2020-26217, CVE-2021-21341, CVE-2021-21342, CVE-2021-21343, CVE-2021-21344, CVE-2021-21346, CVE-2021-21347, CVE-2021-21348, CVE-2021-21349, CVE-2021-21350 and CVE-2021-21351.
The patch for CVE-2021-27807 also addresses CVE-2021-27906.

Oracle Siebel CRM Risk Matrix

This Critical Patch Update contains 6 new security patches for Oracle Siebel CRM. 4 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-24750	Siebel Core – Server Framework	Services (jackson-databind)	HTTP	Yes	8.1	Network	High	None	None	Un- changed	High	High	High	21.5 and Prior
CVE-2020-27216	Siebel Core – Automation	Test Automation (Eclipse Jetty)	None	No	7.8	Local	Low	Low	None	Un- changed	High	High	High	21.5 and Prior
CVE-2017-5637	Siebel Core – Server Framework	Cloud Gateway (Zookeeper)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	21.5 and Prior
CVE-2021-2338	Siebel Apps – Marketing	Email Marketing Stand-Alone	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	21.5 and Prior
CVE-2021-2368	Siebel CRM	Siebel Core – Server Infrastructure	HTTPS	Yes	5.9	Network	High	None	None	Un- changed	High	None	None	21.5 and Prior
CVE-2021-2353	Siebel Core – Server Framework	Loging	None	No	4.4	Local	Low	High	None	Un- changed	High	None	None	21.5 and Prior

Additional CVEs addressed are:

The patch for CVE-2017-5637 also addresses CVE-2019-0201 and CVE-2020-11612.
The patch for CVE-2020-27216 also addresses CVE-2020-27218.

Oracle Supply Chain Risk Matrix

This Critical Patch Update contains 5 new security patches for Oracle Supply Chain. All of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-11979	Oracle Agile Engineering Data Management	Installation Issues (Apache Ant)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	6.2.1.0
CVE-2020-13935	Oracle Agile Engineering Data Management	Installation Issues (Apache Tomcat)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	6.2.1.0
CVE-2012-0881	Oracle Transportation Management	UI Infrastructure (Apache Xerces2 Java Parser)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	6.4.3
CVE-2021-26272	Oracle Agile PLM	Security (CKEditor)	HTTP	Yes	6.5	Network	Low	None	Required	Un- changed	None	None	High	9.3.5, 9.3.6
CVE-2021-24122	Oracle Agile PLM	Folders, Files & Attachments (Apache Tomcat)	HTTP	Yes	5.9	Network	High	None	None	Un- changed	High	None	None	9.3.3, 9.3.6

Additional CVEs addressed are:

The patch for CVE-2020-11979 also addresses CVE-2020-1945.
The patch for CVE-2020-13935 also addresses CVE-2020-13934.
The patch for CVE-2021-24122 also addresses CVE-2020-17527, CVE-2021-25122 and CVE-2021-25329.
The patch for CVE-2021-26272 also addresses CVE-2020-27193 and CVE-2021-26271.

Oracle Support Tools Risk Matrix

This Critical Patch Update contains 1 new security patch for Oracle Support Tools. This vulnerability is remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-11023	OSS Support Tools	Diagnostic Assistant (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	Prior to 2.12.41

Additional CVEs addressed are:

The patch for CVE-2020-11023 also addresses CVE-2019-11358 and CVE-2020-11022.

Oracle Systems Risk Matrix

This Critical Patch Update contains 11 new security patches for Oracle Systems. 9 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2017-5461	Fujitsu M10-1, M10-4, M10-4S, M12-1, M12-2, M12-2S Servers	XCP Firmware (NSS)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	Prior to XCP2400, prior to XCP3100
CVE-2017-16931	Fujitsu M10-1, M10-4, M10-4S, M12-1, M12-2, M12-2S Servers	XCP Firmware (libxml2)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	Prior to XCP2400, prior to XCP3100
CVE-2018-7183	Fujitsu M10-1, M10-4, M10-4S, M12-1, M12-2, M12-2S Servers	XCP Firmware (NTP)	NTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	Prior to XCP2400, prior to XCP3100
CVE-2021-3177	Oracle ZFS Storage Appliance Kit	Operating System Image	Multiple	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	8.8
CVE-2020-10683	StorageTek Tape Analytics SW Tool	Software (dom4j)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	2.3
CVE-2019-10086	Oracle Solaris Cluster	Application Integration (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	4.4
CVE-2018-0739	Fujitsu M10-1, M10-4, M10-4S, M12-1, M12-2, M12-2S Servers	XCP Firmware (OpenSSL)	TLS	Yes	6.5	Network	Low	None	Required	Un- changed	None	None	High	Prior to XCP2400, prior to XCP3100
CVE-2020-5421	StorageTek Tape Analytics SW Tool	Software (Spring Framework)	HTTP	No	6.5	Network	High	Low	Required	Changed	Low	High	None	2.3
CVE-2019-3740	StorageTek Tape Analytics SW Tool	Software (BSAFE Crypto-J)	HTTPS	Yes	6.5	Network	Low	None	Required	Un- changed	High	None	None	2.3
CVE-2016-4429	Fujitsu M10-1, M10-4, M10-4S, M12-1, M12-2, M12-2S Servers	XCP Firmware (glibc)	Multiple	Yes	5.9	Network	High	None	None	Un- changed	None	None	High	Prior to XCP2400, prior to XCP3100
CVE-2021-2381	Oracle Solaris	Kernel	None	No	3.9	Local	Low	Low	Required	Un- changed	None	Low	Low	11

Additional CVEs addressed are:

The patch for CVE-2018-0739 also addresses CVE-2017-3735, CVE-2018-0737 and CVE-2020-1968.
The patch for CVE-2018-7183 also addresses CVE-2020-11868.
The patch for CVE-2019-3740 also addresses CVE-2019-3738 and CVE-2019-3739.
The patch for CVE-2021-3177 also addresses CVE-2020-27783, CVE-2021-20227, CVE-2021-23839, CVE-2021-23840, CVE-2021-23841, CVE-2021-28041, CVE-2021-29921, CVE-2021-3449, CVE-2021-3450, CVE-2021-3520 and CVE-2021-3560.

Oracle Virtualization Risk Matrix

This Critical Patch Update contains 6 new security patches for Oracle Virtualization. 1 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2021-2447	Oracle Secure Global Desktop	Server	Multiple	No	9.9	Network	Low	Low	None	Changed	High	High	High	5.6
CVE-2021-2446	Oracle Secure Global Desktop	Client	Multiple	Yes	9.6	Network	Low	None	Required	Changed	High	High	High	5.6
CVE-2021-2409	Oracle VM VirtualBox	Core	None	No	8.2	Local	Low	High	None	Changed	High	High	High	Prior to 6.1.24
CVE-2021-2443	Oracle VM VirtualBox	Core	None	No	7.3	Local	Low	High	None	Changed	Low	Low	High	Prior to 6.1.24	See Note 1
CVE-2021-2454	Oracle VM VirtualBox	Core	None	No	7.0	Local	High	Low	None	Un- changed	High	High	High	Prior to 6.1.24
CVE-2021-2442	Oracle VM VirtualBox	Core	None	No	6.0	Local	Low	High	None	Changed	None	None	High	Prior to 6.1.24

Notes:

This vulnerability applies to Solaris x86 and Linux systems only.

No Related Posts

Oracle Critical Patch Update Advisory – April 2021

April 19, 2021September 28, 2021 Oracle Leave a comment

Oracle Critical Patch Update Advisory – April 2021

Description

This Critical Patch Update contains 391 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2021 Critical Patch Update: Executive Summary and Analysis.

Affected Products and Patch Information

Security vulnerabilities addressed by this Critical Patch Update affect the products listed below. The product area is shown in the Patch Availability Document column.

Please click on the links in the Patch Availability Document column below to access the documentation for patch availability information and installation instructions.

Affected Products and Versions	Patch Availability Document
Agile Product Lifecycle Management Integration Pack for Oracle E-Business Suite, versions 3.5, 3.6	Oracle Supply Chain Products
Agile Product Lifecycle Management Integration Pack for SAP: Design to Release, versions 3.5, 3.6	Oracle Supply Chain Products
Enterprise Manager Base Platform, version 13.4.0.0	Enterprise Manager
Enterprise Manager for Fusion Middleware, versions 12.2.1.4, 13.4.0.0	Enterprise Manager
Enterprise Manager for Virtualization, version 13.4.0.0	Enterprise Manager
Enterprise Manager Ops Center, version 12.4.0.0	Enterprise Manager
FMW Platform, versions 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Hyperion Analytic Provider Services, versions 11.1.2.4, 12.2.1.4	Fusion Middleware
Hyperion Financial Management, version 11.1.2.4	Fusion Middleware
Instantis EnterpriseTrack, versions 17.1, 17.2, 17.3	Oracle Construction and Engineering Suite
JD Edwards EnterpriseOne Orchestrator, versions prior to 9.2.5.3	JD Edwards
JD Edwards EnterpriseOne Tools, versions prior to 9.2.4.0, prior to 9.2.5.3	JD Edwards
JD Edwards World Security, version A9.4	JD Edwards
MySQL Cluster, versions 8.0.23 and prior	MySQL
MySQL Enterprise Monitor, versions 8.0.23 and prior	MySQL
MySQL Server, versions 5.7.33 and prior, 8.0.23 and prior	MySQL
MySQL Workbench, versions 8.0.23 and prior	MySQL
Oracle Advanced Supply Chain Planning, versions 12.1, 12.2	Oracle Supply Chain Products
Oracle Agile PLM, versions 9.3.3, 9.3.5, 9.3.6	Oracle Supply Chain Products
Oracle API Gateway, version 11.1.2.4.0	Fusion Middleware
Oracle Application Express, versions prior to 20.2	Database
Oracle Application Testing Suite, version 13.3.0.1	Enterprise Manager
Oracle BAM (Business Activity Monitoring), versions 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Oracle Banking Platform, versions 2.4.0, 2.6.2, 2.7.0, 2.7.1, 2.8.0, 2.9.0, 2.10.0	Oracle Banking Platform
Oracle Business Intelligence Enterprise Edition, versions 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Oracle Cloud Infrastructure Storage Gateway, versions prior to 1.4	Contact Support
Oracle Coherence, versions 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0	Fusion Middleware
Oracle Commerce Guided Search, versions 11.3.0, 11.3.1, 11.3.2	Oracle Commerce
Oracle Commerce Merchandising, versions 0, 11.0.0, 11.1, 11.2.0, 11.3.0, 11.3.1, 11.3.2	Oracle Commerce
Oracle Communications Application Session Controller, version 3.9m0p3	Oracle Communications Application Session Controller
Oracle Communications Calendar Server, version 8.0	Oracle Communications Calendar Server
Oracle Communications Contacts Server, version 8.0	Oracle Communications Contacts Server
Oracle Communications Converged Application Server – Service Controller, version 6.2	Oracle Communications Converged Application Server – Service Controller
Oracle Communications Design Studio, version 7.4.2	Oracle Communications Design Studio
Oracle Communications Interactive Session Recorder, versions 6.3, 6.4	Oracle Communications Interactive Session Recorder
Oracle Communications Messaging Server, versions 8.0.2, 8.1, 8.1.0	Oracle Communications Messaging Server
Oracle Communications MetaSolv Solution, versions 6.3.0, 6.3.1	Oracle Communications MetaSolv Solution
Oracle Communications Performance Intelligence Center Software, versions 10.4.0.2, 10.4.0.3	Oracle Communications Performance Intelligence Center (PIC) Software
Oracle Communications Services Gatekeeper, versions 6.0, 6.1, 7.0	Oracle Communications Services Gatekeeper
Oracle Communications Session Border Controller, versions Cz8.2, Cz8.3, Cz8.4	Oracle Communications Session Border Controller
Oracle Communications Session Router, versions Cz8.2, Cz8.3, Cz8.4	Oracle Communications Session Router
Oracle Communications Subscriber-Aware Load Balancer, versions Cz8.2, Cz8.3, Cz8.4	Oracle Communications Subscriber-Aware Load Balancer
Oracle Communications Unified Inventory Management, versions 7.3.4, 7.3.5, 7.4.0, 7.4.1	Oracle Communications Unified Inventory Management
Oracle Communications Unified Session Manager, version SCz8.2.5	Oracle Communications Unified Session Manager
Oracle Database Server, versions 12.1.0.2, 12.2.0.1, 18c, 19c	Database
Oracle E-Business Suite, versions 12.1.1-12.1.3, 12.2.3-12.2.10	E-Business Suite
Oracle Endeca Information Discovery Studio, version 3.2.0.0	Fusion Middleware
Oracle Enterprise Communications Broker, versions PCZ3.1, PCZ3.2, PCZ3.3	Oracle Enterprise Communications Broker
Oracle Enterprise Repository, version 11.1.1.7.0	Fusion Middleware
Oracle Enterprise Session Border Controller, versions Cz8.2, Cz8.3, Cz8.4	Oracle Enterprise Session Border Controller
Oracle Financial Services Analytical Applications Infrastructure, versions 8.0.6-8.1.0	Oracle Financial Services Analytical Applications Infrastructure
Oracle FLEXCUBE Direct Banking, versions 12.0.2, 12.0.3	Contact Support
Oracle FLEXCUBE Private Banking, versions 12.0.0, 12.1.0	Contact Support
Oracle Fusion Middleware, versions 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Oracle Fusion Middleware MapViewer, version 12.2.1.4.0	Fusion Middleware
Oracle Global Lifecycle Management OPatch, versions prior to 12.2.0.1.22	Global Lifecycle Management
Oracle GraalVM Enterprise Edition, versions 19.3.5, 20.3.1.2, 21.0.0.2	Oracle GraalVM Enterprise Edition
Oracle Graph Server and Client	Database
Oracle Health Sciences Empirica Signal, versions 9.0, 9.1	Health Sciences
Oracle Health Sciences Information Manager, versions 3.0.0-3.0.2	Health Sciences
Oracle Healthcare Foundation, versions 7.1.5, 7.2.2, 7.3.0, 7.3.1, 8.0.1	Health Sciences
Oracle Hospitality Cruise Shipboard Property Management System, version 20.1.0	Oracle Hospitality Cruise Shipboard Property Management System
Oracle Hospitality Inventory Management, version 9.1.0	Oracle Hospitality Inventory Management
Oracle Hospitality OPERA 5, versions 5.5, 5.6	Oracle Hospitality OPERA 5 Property Services
Oracle Hospitality RES 3700, versions 5.7.0-5.7.6	Oracle Hospitality RES
Oracle HTTP Server, versions 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Oracle Identity Manager Connector, version 11.1.1.5.0	Fusion Middleware
Oracle iLearning, versions 6.2, 6.3	iLearning
Oracle Insurance Data Gateway, version 1.0.2.3	Oracle Insurance Applications
Oracle Java SE, versions 7u291, 8u281, 11.0.10, 16	Java SE
Oracle Java SE Embedded, version 8u281	Java SE
Oracle NoSQL Database, versions prior to 20.3	NoSQL Database
Oracle Outside In Technology, version 8.5.5	Fusion Middleware
Oracle Platform Security for Java, versions 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Oracle Rapid Planning, version 12.1.3	Oracle Supply Chain Products
Oracle REST Data Services, versions prior to 20.4.3.50.1904	Database
Oracle Retail Advanced Inventory Planning, version 14.1	Retail Applications
Oracle Retail Assortment Planning, version 16.0.3	Retail Applications
Oracle Retail Back Office, version 14.1	Retail Applications
Oracle Retail Category Management Planning & Optimization, version 16.0.3	Retail Applications
Oracle Retail Central Office, version 14.1	Retail Applications
Oracle Retail EFTLink, versions 15.0.2, 16.0.3, 17.0.2, 18.0.1, 19.0.1, 20.0.0	Retail Applications
Oracle Retail Insights Cloud Service Suite, version 19.0	Retail Applications
Oracle Retail Item Planning, version 16.0.3	Retail Applications
Oracle Retail Macro Space Optimization, version 16.0.3	Retail Applications
Oracle Retail Merchandise Financial Planning, version 16.0.3	Retail Applications
Oracle Retail Merchandising System, version 16.0.3	Retail Applications
Oracle Retail Point-of-Service, version 14.1	Retail Applications
Oracle Retail Predictive Application Server, versions 14.1, 15.0, 16.0	Retail Applications
Oracle Retail Regular Price Optimization, version 16.0.3	Retail Applications
Oracle Retail Replenishment Optimization, version 16.0.3	Retail Applications
Oracle Retail Returns Management, version 14.1	Retail Applications
Oracle Retail Sales Audit, version 14.0	Retail Applications
Oracle Retail Size Profile Optimization, version 16.0.3	Retail Applications
Oracle Retail Store Inventory Management, versions 14.1.3.10, 15.0.3.5, 16.0.3.5	Retail Applications
Oracle Retail Xstore Point of Service, versions 15.0.4, 16.0.6, 17.0.4, 18.0.3, 19.0.2	Retail Applications
Oracle SD-WAN Aware, version 8.2	Oracle SD-WAN Aware
Oracle SD-WAN Edge, versions 8.2, 9.0	Oracle SD-WAN Edge
Oracle Secure Backup	Oracle Secure Backup
Oracle Secure Global Desktop, version 5.6	Virtualization
Oracle Security Service, versions 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Oracle Service Bus, versions 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Oracle Solaris, versions 10, 11	Systems
Oracle Spatial Studio, versions prior to 19.1.0, prior to 20.1.1	Database
Oracle SQL Developer, versions prior to 20.4.1.407.6	Database
Oracle Storage Cloud Software Appliance, versions prior to 16.3.1.4.2	Contact Support
Oracle TimesTen In-Memory Database	Database
Oracle Utilities Framework, versions 4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0-4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0	Oracle Utilities Applications
Oracle VM VirtualBox, versions prior to 6.1.20	Virtualization
Oracle WebCenter Portal, versions 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Oracle WebLogic Server, versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0	Fusion Middleware
Oracle WebLogic Server Proxy Plug-In, versions 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Oracle ZFS Storage Appliance Kit, version 8.8	Systems
OSS Support Tools, versions prior to 2.12.41	Support Tools
PeopleSoft Enterprise CS Campus Community, version 9.2	PeopleSoft
PeopleSoft Enterprise FIN Common Application Objects, version 9.2	PeopleSoft
PeopleSoft Enterprise FIN Expenses, version 9.2	PeopleSoft
PeopleSoft Enterprise PeopleTools, versions 8.56, 8.57, 8.58	PeopleSoft
PeopleSoft Enterprise PT PeopleTools, versions 8.56, 8.57, 8.58	PeopleSoft
PeopleSoft Enterprise SCM eProcurement, version 9.2	PeopleSoft
PeopleSoft Enterprise SCM Purchasing, version 9.2	PeopleSoft
Primavera Gateway, versions 17.12.0-17.12.10	Oracle Construction and Engineering Suite
Primavera Unifier, versions 16.1, 16.2, 17.7-17.12, 18.8, 19.12, 20.12	Oracle Construction and Engineering Suite
Siebel Applications, versions 21.2 and prior	Siebel

Note:

Vulnerabilities affecting either Oracle Database or Oracle Fusion Middleware may affect Oracle Fusion Applications, so Oracle customers should refer to Oracle Fusion Applications Critical Patch Update Knowledge Document, My Oracle Support Note 1967316.1 for information on patches to be applied to Fusion Application environments.
Vulnerabilities affecting Oracle Solaris may affect Oracle ZFSSA so Oracle customers should refer to the Oracle and Sun Systems Product Suite Critical Patch Update Knowledge Document, My Oracle Support Note 2160904.1 for information on minimum revisions of security patches required to resolve ZFSSA issues published in Critical Patch Updates and Solaris Third Party bulletins.
Solaris Third Party Bulletins are used to announce security patches for third party software distributed with Oracle Solaris. Solaris 10 customers should refer to the latest patch-sets which contain critical security fixes and detailed in Systems Patch Availability Document. Please see Reference Index of CVE IDs and Solaris Patches (My Oracle Support Note 1448883.1) for more information.
Users running Java SE with a browser can download the latest release from https://java.com. Users on the Windows and Mac OS X platforms can also use automatic updates to get the latest release.

Risk Matrix Content

Security vulnerabilities are scored using CVSS version 3.1 (see Oracle CVSS Scoring for an explanation of how Oracle applies CVSS version 3.1).

Workarounds

Skipped Critical Patch Updates

Critical Patch Update Supported Products and Versions

Credit Statement

The following people or organizations reported security vulnerabilities addressed by this Critical Patch Update to Oracle:

0xfoxone: CVE-2021-2240
Alessandra Zullo: CVE-2021-2152
Andrej Simko of Accenture: CVE-2021-2150, CVE-2021-2155, CVE-2021-2182, CVE-2021-2183, CVE-2021-2184, CVE-2021-2185, CVE-2021-2186, CVE-2021-2187, CVE-2021-2188, CVE-2021-2189, CVE-2021-2190, CVE-2021-2195, CVE-2021-2198, CVE-2021-2199, CVE-2021-2200
Aobo Wang of Chaitin Security Research Lab: CVE-2021-2312
Artur Obuchowski and Jakub Sajniak of STM Cyber: CVE-2021-2053
Bartłomiej Stasiek: CVE-2021-2218, CVE-2021-2219, CVE-2021-2220
Billy Jheng Bing-Jhong (st424204) working with Trend Micro Zero Day Initiative: CVE-2021-2250, CVE-2021-2321
Calvin Fong (Lord_Idiot) of STAR Labs working with Trend Micro Zero Day Initiative: CVE-2021-2250, CVE-2021-2321
Charley Celice of Quorum Cyber: CVE-2021-2214
ChenNan of Chaitin Security Research Lab: CVE-2021-2280, CVE-2021-2281, CVE-2021-2282, CVE-2021-2283, CVE-2021-2284, CVE-2021-2285, CVE-2021-2286, CVE-2021-2287, CVE-2021-2306
Cl0und of Syclover Security Team: CVE-2021-2135, CVE-2021-2136
Codeplutos of AntGroup FG Security Lab: CVE-2021-2135
Damian Bury: CVE-2021-2140
DongJun Shin working with Trend Micro Zero Day Initiative: CVE-2021-2309
Emad Al-Mousa of Saudi Aramco: CVE-2021-2173, CVE-2021-2175, CVE-2021-2207
Esteban Montes Morales of Accenture: CVE-2021-2181
Ghost Said: CVE-2021-2204
Girlelecta: CVE-2021-2242
JungHyun Kim (jidoc01) of VirtualBoBs working with Trend Micro Zero Day Initiative: CVE-2021-2279, CVE-2021-2291
JunYoung Park (candymate) of VirtualBoBs working with Trend Micro Zero Day Initiative: CVE-2021-2266
Kajetan Rostojek: CVE-2021-2191
Kun Yang of Chaitin Security Research Lab: CVE-2021-2280, CVE-2021-2281, CVE-2021-2282, CVE-2021-2283, CVE-2021-2284, CVE-2021-2285, CVE-2021-2286, CVE-2021-2287, CVE-2021-2306, CVE-2021-2312
Longofo of Knownsec 404 Team: CVE-2021-2211, CVE-2021-2277, CVE-2021-2294
Lucas Leong (wmliang) of Trend Micro Zero Day Initiative: CVE-2021-2296, CVE-2021-2297
Markus Loewe: CVE-2021-2161
Martin Neumann of Accenture: CVE-2021-2205, CVE-2021-2206, CVE-2021-2209, CVE-2021-2210
Martí Guasch Jimenez: CVE-2021-2167
Matthias Gerstner of SUSE: CVE-2021-2264
Matthias Kaiser of Apple Information Security: CVE-2021-2135
Max Van Amerongen (maxpl0it) working with Trend Micro Zero Day Initiative: CVE-2021-2145, CVE-2021-2310
Maxime Escourbiac of Michelin CERT: CVE-2021-2153
Michał Skowron: CVE-2021-2219
Muhammad Alifa Ramdhan (n0psledbyte) working with Trend Micro Zero Day Initiative: CVE-2021-2250, CVE-2021-2321
Okan Cokun of Biznet: CVE-2021-2008
Patrick Star of BMH Security Team: CVE-2021-2204
peterjson of RedTeam@VNG Corporation working with Trend Micro Zero Day Initiative: CVE-2021-2244
Quynh Le of VNPT ISC working with Trend Micro Zero Day Initiative: CVE-2021-2211, CVE-2021-2302, CVE-2021-2303
r00t4dm at Cloud-Penetrating Arrow Lab: CVE-2021-2211, CVE-2021-2277, CVE-2021-2294
Spyridon Chatzimichail of OTE Hellenic Telecommunications Organization S.A.: CVE-2021-2158
thiscodecc of MoyunSec V-Lab: CVE-2021-2211, CVE-2021-2277, CVE-2021-2294
threedr3am: CVE-2021-2136
Tomasz Wiśniewski: CVE-2021-2219
Torben Capiau of Accenture: CVE-2021-2197
UnicodeSec potats0: CVE-2021-2211
Venustech ADLab: CVE-2021-2135
Veronica Venturi: CVE-2021-2152
Waleed Ezz Eldin of Cysiv (Previously SecureMisr): CVE-2021-2141
Wei Bo of UGUARDSEC Security Team: CVE-2021-2157
Will Dormann of CERT/CC: CVE-2021-2307
Xianglai Liu of Dbappsecurity Team: CVE-2021-2277
Yaoguang Chen of Ant Security Light-Year Lab: CVE-2021-2169, CVE-2021-2230
Yi Ren of Alibaba: CVE-2021-2203
Yuyue Wang of Alibaba: CVE-2021-2203

Security-In-Depth Contributors

In this Critical Patch Update, Oracle recognizes the following for contributions to Oracle’s Security-In-Depth program:

Artem
Markus Loewe
Mohit Rawat
Ofir Moskovitch

On-Line Presence Security Contributors

For this quarter, Oracle recognizes the following for contributions to Oracle’s On-Line Presence Security program:

Abdulaziz Almisfer
Abhishek Misal
Aditra Andri Laksana
Adrián Pedrazzoli
Ali Hassan Ghori
Ankur Vaidya
Aswin Krishna (733n_wolf)
Aurélien Salomon
Bader Almutairi
Danish Tariq
Derek Chapman
George Crook
Hamit Cibo
Jehad Alqurashi
Luca Ottoni
Mohamed Ahmed Naji
Mohamed ELobeid
Qasim Shaikh
Rahul PS
Reworr
Srikar V – exp1o1t9r
Waleed Ezz Eldin of Cysiv (Previously SecureMisr) [2 reports]
Yevgeny Zharovsky

Critical Patch Update Schedule

Critical Patch Updates are released on the Tuesday closest to the 17th day of January, April, July and October. The next four dates are:

20 July 2021
19 October 2021
18 January 2022
19 April 2022

References

Modification History

Date	Note
2021-September-4	Rev 7. Removed CVE-2021-21345 from the additional CVE list of BAM.
2021-July-28	Rev 6. Removed Oracle Weblogic Server version 12.1.3.0.0 for CVE-2021-2135.
2021-June-29	Rev 5. Affected version changes to CVE-2020-10683 in the Fusion Middleware Matrix.
2021-May-5	Rev 4. Added CVE-2019-17638 to the Fusion Middleware Matrix for Weblogic Server and it is CVSS 0.
2021-April-26	Rev 3. Added CVE-2021-2321 to the Virtualization risk matrix and updated the Credit Statement section.
2021-April-22	Rev 2. Affected version changed for CVE-2021-2008, Note added for CVE-2021-2264, Database matrix client-only updated.
2021-April-20	Rev 1. Initial Release.

Oracle Database Products Risk Matrices

This Critical Patch Update contains 18 new security patches for Oracle Database Products divided as follows:

10 new security patches for Oracle Database Products
1 new security patch for Oracle Global Lifecycle Management
No new security patches for Oracle Graph Server and Client, but third party patches are provided
4 new security patches for Oracle NoSQL Database
1 new security patch for Oracle REST Data Services
No new security patches for Oracle Secure Backup, but third party patches are provided
2 new security patches for Oracle Spatial Studio
No new security patches for Oracle TimesTen In-Memory Database, but third party patches are provided

Oracle Database Server Risk Matrix

This Critical Patch Update contains 10 new security patches plus additional third party patches noted below for Oracle Database Products. 4 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. 1 of these patches are applicable to client-only installations, i.e., installations that do not have the Oracle Database Server installed. The English text form of this Risk Matrix can be found here.

CVE#	Component	Package and/or Privilege Required	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Component	Package and/or Privilege Required	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-5360	Oracle Database – Enterprise Edition Security (Dell BSAFE Micro Edition Suite)	None	Multiple	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	12.1.0.2, 12.2.0.1, 18c, 19c
CVE-2020-17527	Workload Manager (Apache Tomcat)	None	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	High	None	None	18c, 19c
CVE-2019-3740	Oracle Database – Enterprise Edition (Dell BSAFE Crypto-J)	None	Oracle Net	Yes	6.5	Network	Low	None	Required	Un- changed	High	None	None	12.1.0.2, 12.2.0.1, 18c, 19c
CVE-2020-11023	Oracle Application Express (jQuery)	None	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	Prior to 20.2
CVE-2021-2234	Java VM	Create Session	Oracle Net	No	5.3	Network	High	Low	None	Un- changed	None	High	None	12.1.0.2, 12.2.0.1, 18c, 19c
CVE-2020-7760	Oracle Application Express (CodeMirror)	Valid User Account	HTTP	No	4.3	Network	Low	Low	None	Un- changed	None	None	Low	Prior to 20.2
CVE-2021-2173	Recovery	DBA Level Account	Oracle Net	No	4.1	Network	Low	High	None	Changed	Low	None	None	12.1.0.2, 12.2.0.1, 18c, 19c
CVE-2021-2175	Database Vault	Create Any View, Select Any View	Oracle Net	No	2.7	Network	Low	High	None	Un- changed	Low	None	None	12.1.0.2, 12.2.0.1, 18c, 19c
CVE-2021-2245	Oracle Database – Enterprise Edition Unified Audit	Create Audit Policy	Oracle Net	No	2.7	Network	Low	High	None	Un- changed	None	Low	None	18c,19c
CVE-2021-2207	Oracle Database – Enterprise Edition	RMAN executable	Local Logon	No	2.3	Local	Low	High	None	Un- changed	None	Low	None	12.1.0.2, 12.2.0.1, 18c, 19c

Additional CVEs addressed are:

The patch for CVE-2019-3740 also addresses CVE-2019-3738 and CVE-2019-3739.
The patch for CVE-2020-11023 also addresses CVE-2019-11358 and CVE-2020-11022.
The patch for CVE-2020-17527 also addresses CVE-2020-13943 and CVE-2020-9484.
The patch for CVE-2020-5360 also addresses CVE-2020-5359.

Additional patches are included in this Critical Patch Update for the following non-exploitable CVEs in this Oracle product family:

Oracle Database Configuration Assistant (Apache Commons Compress): CVE-2019-12402.

Oracle Database Server Client-Only Installations:

The following Oracle Database Server Vulnerability included in the Critical Patch Update affects client-only installations: CVE-2020-5360.

Oracle Global Lifecycle Management Risk Matrix

This Critical Patch Update contains 1 new security patch plus additional third party patches noted below for Oracle Global Lifecycle Management. This vulnerability is remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2019-3740	Oracle Global Lifecycle Management OPatch	Patch Installer (Dell BSAFE Crypto-J)	Oracle Net	Yes	6.5	Network	Low	None	Required	Un- changed	High	None	None	Prior to 12.2.0.1.22

Additional patches are included in this Critical Patch Update for the following non-exploitable CVEs in this Oracle product family:

Oracle Global Lifecycle Management OPatch
- Patch Installer (Apache Commons Compress): CVE-2019-12402.
- Patch Installer (jackson-databind): CVE-2020-36189, CVE-2020-14195 and CVE-2020-25649.

Oracle Graph Server and Client Risk Matrix

This Critical Patch Update contains no new security patches but does include third party patches noted below for Oracle Graph Server and Client. Please refer to previous Critical Patch Update Advisories if the last Critical Patch Update was not applied for the Oracle Graph Server and Client. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
There are no exploitable vulnerabilities for these products. Third party patches for non-exploitable CVEs are noted below.

Additional patches are included in this Critical Patch Update for the following non-exploitable CVEs in this Oracle product family:

Oracle Graph Server and Client
- Packaging/Install (lodash): CVE-2020-8203.

Oracle NoSQL Database Risk Matrix

This Critical Patch Update contains 4 new security patches plus additional third party patches noted below for Oracle NoSQL Database. 3 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-13956	Oracle NoSQL Database	Administration (Apache HttpClient)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	Prior to 20.3
CVE-2020-11612	Oracle NoSQL Database	Administration (Netty)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	Prior to 20.3
CVE-2021-22883	Oracle NoSQL Database	Administration (Node.js)	Multiple	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	Prior to 20.3
CVE-2020-8908	Oracle NoSQL Database	Administration (Google Guava)	Local Logon	No	3.3	Local	Low	Low	None	Un- changed	Low	None	None	Prior to 20.3

Additional CVEs addressed are:

The patch for CVE-2020-11612 also addresses CVE-2021-21290.
The patch for CVE-2021-22883 also addresses CVE-2021-22884 and CVE-2021-23840.

Additional patches are included in this Critical Patch Update for the following non-exploitable CVEs in this Oracle product family:

Oracle NoSQL Database
- Administration (Go): CVE-2020-24553.
- Administration (jackson-databind): CVE-2019-14379, CVE-2019-12086, CVE-2019-16942, CVE-2020-14195, CVE-2020-24616, CVE-2020-24750, CVE-2020-25649 and CVE-2020-36189.

Oracle REST Data Services Risk Matrix

This Critical Patch Update contains 1 new security patch plus additional third party patches noted below for Oracle REST Data Services. This vulnerability is remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-27223	Oracle REST Data Services	General (Eclipse Jetty)	HTTP	Yes	5.3	Network	Low	None	None	Un- changed	None	None	Low	Prior to 20.4.3.050.1904

Additional CVEs addressed are:

The patch for CVE-2020-27223 also addresses CVE-2020-27218.

Additional patches are included in this Critical Patch Update for the following non-exploitable CVEs in this Oracle product family:

Oracle REST Data Services
- General (jackson-databind): CVE-2019-14379, CVE-2019-12086, CVE-2019-16942, CVE-2020-14060, CVE-2020-14061, CVE-2020-14062, CVE-2020-14195, CVE-2020-24750, CVE-2020-25649 and CVE-2020-36189.

Oracle Secure Backup Risk Matrix

This Critical Patch Update contains no new security patches but does include third party patches noted below for Oracle Secure Backup. Please refer to previous Critical Patch Update Advisories if the last Critical Patch Update was not applied for Oracle Secure Backup. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
There are no exploitable vulnerabilities for these products. Third party patches for non-exploitable CVEs are noted below.

Additional patches are included in this Critical Patch Update for the following non-exploitable CVEs in this Oracle product family:

Oracle Secure Backup
- Install (Flexera InstallShield): CVE-2016-2542.
- Oracle Secure Backup (PHP): CVE-2020-7060, CVE-2020-7059 and CVE-2020-7069.

Oracle Spatial Studio Risk Matrix

This Critical Patch Update contains 2 new security patches plus additional third party patches noted below for Oracle Spatial Studio. 1 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-13956	Oracle Spatial Studio	Install (Apache HttpClient)	HTTP	Yes	5.3	Network	Low	None	None	Un- changed	None	Low	None	Prior to 20.1.1
CVE-2020-7760	Oracle Spatial Studio	Install (CodeMirror)	HTTP	No	4.3	Network	Low	Low	None	Un- changed	None	None	Low	Prior to 19.1.0

Additional patches are included in this Critical Patch Update for the following non-exploitable CVEs in this Oracle product family:

Oracle Spatial Studio
- Install (Apache POI): CVE-2019-12415.
- Install (jackson-databind): CVE-2020-36189, CVE-2019-12086, CVE-2020-14195, CVE-2020-24750, CVE-2020-25649, CVE-2020-35490, CVE-2020-35491, CVE-2020-35728, CVE-2020-36179, CVE-2020-36180, CVE-2020-36181, CVE-2020-36182, CVE-2020-36183, CVE-2020-36184, CVE-2020-36185, CVE-2020-36186, CVE-2020-36187 and CVE-2020-36188.

Oracle SQL Developer Risk Matrix

This Critical Patch Update contains 1 new security patch plus additional third party patches noted below for Oracle SQL Developer. This vulnerability is remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-13956	Oracle SQL Developer (Apache HttpClient)	Install (Apache HttpClient)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	Prior to 20.4.1.407.0006

Additional patches are included in this Critical Patch Update for the following non-exploitable CVEs in this Oracle product family:

Oracle SQL Developer
- General Infrastructure (Bootstrap): CVE-2019-8331, CVE-2018-14040, CVE-2018-14041 and CVE-2018-14042.
- General Infrastructure (jQuery): CVE-2020-11023, CVE-2019-11358 and CVE-2020-11022.
- Install (Apache Kafka): CVE-2019-12399.
- Install (Apache Log4j): CVE-2020-9488.
- Install (dom4j): CVE-2018-1000632.
- NoSQL Extension (jackson-databind): CVE-2020-25649.
Oracle SQL Developer Install
- Install (Apache POI): CVE-2019-12415.

Oracle TimesTen In-Memory Database Risk Matrix

This Critical Patch Update contains no new security patches but does include third party patches noted below for Oracle TimesTen In-Memory Database. Please refer to previous Critical Patch Update Advisories if the last Critical Patch Update was not applied for Oracle TimesTen In-Memory Database. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
There are no exploitable vulnerabilities for these products. Third party patches for non-exploitable CVEs are noted below.

Additional patches are included in this Critical Patch Update for the following non-exploitable CVEs in this Oracle product family:

Oracle TimesTen In-Memory Database
- Install (Go): CVE-2020-24553, CVE-2020-14039, CVE-2020-15586, CVE-2020-16845 and CVE-2020-7919.
- Install (Perl): CVE-2020-10878 and CVE-2020-12723.
- Kubernetes Operator (Go): CVE-2020-24553, CVE-2020-14039, CVE-2020-15586, CVE-2020-16845 and CVE-2020-7919.

Oracle Commerce Risk Matrix

This Critical Patch Update contains 4 new security patches for Oracle Commerce. All of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2019-12423	Oracle Commerce Guided Search	Content Acquisition System (Apache CXF)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	High	None	None	11.3.2
CVE-2020-11022	Oracle Commerce Guided Search	Workbench, Experience Manager (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	11.3.0, 11.3.1, 11.3.2
CVE-2020-11022	Oracle Commerce Merchandising	Business Control Center (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	11.3.0, 11.3.1, 11.3.2
CVE-2020-27193	Oracle Commerce Merchandising	Experience Manager, Business Control Center (CKEditor)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	11.0.0, 11.1,0, 11.2.0, 11.3.0, 11.3.1, 11.3.2

Additional CVEs addressed are:

The patch for CVE-2019-12423 also addresses CVE-2019-12406, CVE-2019-1241, CVE-2019-12419 and CVE-2019-17573.
The patch for CVE-2020-11022 also addresses CVE-2019-11358 and CVE-2020-11023.
The patch for CVE-2020-27193 also addresses CVE-2020-9281.

Oracle Communications Applications Risk Matrix

This Critical Patch Update contains 13 new security patches for Oracle Communications Applications. 12 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-11612	Oracle Communications Design Studio	Inventory Services (Netty)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	7.4.2
CVE-2019-0228	Oracle Communications Messaging Server	Message Store (Apache PDFBox)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	8.1.0
CVE-2020-11612	Oracle Communications Messaging Server	Message Store (Netty)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	8.1.0
CVE-2020-28052	Oracle Communications Messaging Server	Message Store (Bouncy Castle Java Library)	HTTPS	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	8.0.2
CVE-2020-5421	Oracle Communications Unified Inventory Management	Reservations (Spring Framework)	HTTP	No	8.8	Network	Low	Low	None	Un- changed	High	High	High	7.3.4, 7.3.5
CVE-2020-24750	Oracle Communications Calendar Server	Event Reminders (jackson-databind)	HTTP	Yes	8.1	Network	High	None	None	Un- changed	High	High	High	8.0
CVE-2020-24750	Oracle Communications Contacts Server	Contact Sharing (jackson-databind)	HTTP	Yes	8.1	Network	High	None	None	Un- changed	High	High	High	8.0
CVE-2020-24750	Oracle Communications Messaging Server	Security (jackson-databind)	HTTP	Yes	8.1	Network	High	None	None	Un- changed	High	High	High	8.1
CVE-2020-13871	Oracle Communications Messaging Server	Message Store (SQLite)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	8.1
CVE-2020-11979	Oracle Communications Unified Inventory Management	Security Component (Apache Ant)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	7.4.0, 7.4.1
CVE-2019-10086	Oracle Communications Unified Inventory Management	Inventory Group (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	7.3.4, 7.3.5, 7.4.0, 7.4.1
CVE-2020-13954	Oracle Communications Messaging Server	Message Store (Apache CXF)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.1
CVE-2020-11987	Oracle Communications MetaSolv Solution	Planning and Modeling (Apache Batik)	HTTP	Yes	5.3	Network	Low	None	None	Un- changed	None	Low	None	6.3.0, 6.3.1

Additional CVEs addressed are:

The patch for CVE-2020-13871 also addresses CVE-2020-11655, CVE-2020-11656, CVE-2020-15358 and CVE-2020-9327.
The patch for CVE-2020-13954 also addresses CVE-2020-25649, CVE-2020-28052 and CVE-2020-36189.
The patch for CVE-2020-24750 also addresses CVE-2020-24616.
The patch for CVE-2020-28052 also addresses CVE-2020-13954, CVE-2020-25649 and CVE-2020-36189.

Oracle Communications Risk Matrix

This Critical Patch Update contains 22 new security patches for Oracle Communications. 9 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-28052	Oracle Communications Application Session Controller	Security (Bouncy Castle Java Library)	HTTPS	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	3.9m0p3
CVE-2021-22112	Oracle Communications Interactive Session Recorder	Provision API (Spring Security)	HTTP	No	8.8	Network	Low	Low	None	Un- changed	High	High	High	6.3, 6.4
CVE-2020-10188	Oracle Communications Performance Intelligence Center Software	Mediation server (Telnet)	Telnet	No	8.3	Network	Low	Low	None	Un- changed	High	High	Low	10.4.0.2
CVE-2020-25649	Oracle Communications Interactive Session Recorder	Provision API (jackson-databind)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	6.3, 6.4
CVE-2020-1971	Oracle Communications Session Border Controller	Routing (OpenSSL)	TLS	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	Cz8.2, Cz8.3, Cz8.4
CVE-2020-25649	Oracle SD-WAN Edge	Config (jackson-databind)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	9.0
CVE-2020-17527	Oracle SD-WAN Edge	MGMT (Apache Tomcat)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	High	None	None	9.0
CVE-2019-10086	Oracle Communications Performance Intelligence Center Software	PMAC (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	10.4.0.3
CVE-2020-8203	Oracle Communications Session Border Controller	Routing (Lodash)	HTTP	No	6.4	Network	High	Low	Required	Un- changed	None	High	High	Cz8.4
CVE-2020-8203	Oracle Communications Session Router	Routing (Lodash)	HTTP	No	6.4	Network	High	Low	Required	Un- changed	None	High	High	Cz8.4
CVE-2020-8203	Oracle Communications Subscriber-Aware Load Balancer	Routing (Lodash)	HTTP	No	6.4	Network	High	Low	Required	Un- changed	None	High	High	Cz8.3, Cz8.4
CVE-2020-8203	Oracle Enterprise Communications Broker	Routing (Lodash)	HTTP	No	6.4	Network	High	Low	Required	Un- changed	None	High	High	PCZ3.3
CVE-2019-3900	Oracle SD-WAN Edge	OS (Linux Kernel)	Multiple	No	6.3	Network	High	Low	None	Changed	None	None	High	8.2
CVE-2020-1927	Oracle SD-WAN Aware	OS (Linux Kernel)	Multiple	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.2
CVE-2020-17521	Oracle Communications Services Gatekeeper	PRM (Apache Groovy)	None	No	5.5	Local	Low	Low	None	Un- changed	High	None	None	6.0, 6.1, 7.0
CVE-2020-11987	Oracle Communications Application Session Controller	Security (Apache Batik)	HTTP	Yes	5.3	Network	Low	None	None	Un- changed	None	Low	None	3.9m0p3
CVE-2020-27218	Oracle Communications Converged Application Server – Service Controller	SC Admin server (Eclipse Jetty)	HTTP	Yes	4.8	Network	High	None	None	Un- changed	None	Low	Low	6.2
CVE-2020-1971	Oracle Communications Session Router	Routing (OpenSSL)	TLS	No	4.2	Network	High	High	Required	Un- changed	None	None	High	Cz8.2, Cz8.3, Cz8.4
CVE-2020-1971	Oracle Communications Subscriber-Aware Load Balancer	Routing (OpenSSL)	TLS	No	4.2	Network	High	High	Required	Un- changed	None	None	High	Cz8.2, Cz8.3, Cz8.4
CVE-2020-1971	Oracle Communications Unified Session Manager	Routing (OpenSSL)	TLS	No	4.2	Network	High	High	Required	Un- changed	None	None	High	SCz8.2.5
CVE-2020-1971	Oracle Enterprise Communications Broker	Routing (OpenSSL)	TLS	No	4.2	Network	High	High	Required	Un- changed	None	None	High	PCZ3.1, PCZ3.2, PCZ3.3
CVE-2020-1971	Oracle Enterprise Session Border Controller	Routing (OpenSSL)	TLS	No	4.2	Network	High	High	Required	Un- changed	None	None	High	Cz8.2, Cz8.3, Cz8.4

Additional CVEs addressed are:

The patch for CVE-2019-3900 also addresses CVE-2018-14613, CVE-2018-16884, CVE-2019-10638, CVE-2019-10639, CVE-2019-11487, CVE-2019-11599, CVE-2019-14898, CVE-2019-15218, CVE-2019-16746, CVE-2019-17075, CVE-2019-17133, CVE-2019-18885, CVE-2019-19052, CVE-2019-19063, CVE-2019-19066, CVE-2019-19073, CVE-2019-19074, CVE-2019-19078, CVE-2019-19535, CVE-2019-19922, CVE-2019-20812, CVE-2019-3874, CVE-2019-5108, CVE-2020-10751, CVE-2020-10769, CVE-2020-12114, CVE-2020-12771, CVE-2020-16166 and CVE-2020-24394.
The patch for CVE-2020-1927 also addresses CVE-2019-10098.
The patch for CVE-2020-25649 also addresses CVE-2020-35490, CVE-2020-35491, CVE-2020-35728, CVE-2020-36179, CVE-2020-36180, CVE-2020-36181, CVE-2020-36182, CVE-2020-36183, CVE-2020-36184, CVE-2020-36185, CVE-2020-36186, CVE-2020-36187, CVE-2020-36188 and CVE-2020-36189.
The patch for CVE-2020-27218 also addresses CVE-2020-27216.

Oracle Construction and Engineering Risk Matrix

This Critical Patch Update contains 8 new security patches for Oracle Construction and Engineering. 6 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2019-0219	Instantis EnterpriseTrack	Browser (Apache Cordova InAppBrowser)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	17.1, 17.2, 17.3
CVE-2020-17527	Instantis EnterpriseTrack	WebServer (Apache Tomcat)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	High	None	None	17.1, 17.2, 17.3
CVE-2020-11022	Primavera Unifier	Core UI (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	16.1, 16.2, 17.7-17.12, 18.8, 19.12, 20.12
CVE-2016-5725	Primavera Gateway	Admin (JCraft JSch)	HTTP	Yes	5.9	Network	High	None	None	Un- changed	None	High	None	17.12.0-17.12.10
CVE-2020-17521	Primavera Gateway	Admin (Apache Groovy)	None	No	5.5	Local	Low	Low	None	Un- changed	High	None	None	17.12.0-17.12.10
CVE-2020-17521	Primavera Unifier	Platform (Apache Groovy)	None	No	5.5	Local	Low	Low	None	Un- changed	High	None	None	16.1, 16.2, 17.7-17.12, 18.8, 19.12, 20.12
CVE-2020-11987	Instantis EnterpriseTrack	Dashboards and Reports (Apache Batik)	HTTP	Yes	5.3	Network	Low	None	None	Un- changed	None	Low	None	17.1, 17.2, 17.3
CVE-2020-13956	Primavera Unifier	Core (HTTP Client)	HTTP	Yes	5.3	Network	Low	None	None	Un- changed	None	Low	None	16.1, 16.2, 17.7-17.12, 18.8, 19.12, 20.12

Additional CVEs addressed are:

The patch for CVE-2020-11022 also addresses CVE-2020-11023.

Oracle E-Business Suite Risk Matrix

This Critical Patch Update contains 70 new security patches plus additional third party patches noted below for Oracle E-Business Suite. 22 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

Oracle E-Business Suite products include Oracle Database and Oracle Fusion Middleware components that are affected by the vulnerabilities listed in the Oracle Database and Oracle Fusion Middleware sections. The exposure of Oracle E-Business Suite products is dependent on the Oracle Database and Oracle Fusion Middleware versions being used. Oracle Database and Oracle Fusion Middleware security updates are not listed in the Oracle E-Business Suite risk matrix. However, since vulnerabilities affecting Oracle Database and Oracle Fusion Middleware versions may affect Oracle E-Business Suite products, Oracle recommends that customers apply the April 2021 Critical Patch Update to the Oracle Database and Oracle Fusion Middleware components of Oracle E-Business Suite. For information on what patches need to be applied to your environments, refer to Oracle E-Business Suite Release 12 Critical Patch Update Knowledge Document (April 2021), My Oracle Support Note 2759182.1.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2021-2200	Oracle Applications Framework	Home page	HTTP	Yes	9.1	Network	Low	None	None	Un- changed	High	High	None	12.2.10
CVE-2021-2205	Oracle Marketing	Marketing Administration	HTTP	Yes	9.1	Network	Low	None	None	Un- changed	High	High	None	12.2.7-12.2.10
CVE-2021-2209	Oracle Email Center	Message Display	HTTP	No	8.5	Network	Low	Low	None	Changed	High	Low	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2182	Oracle iStore	Shopping Cart	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2183	Oracle iStore	Shopping Cart	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2184	Oracle iStore	Shopping Cart	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2185	Oracle iStore	Shopping Cart	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2186	Oracle iStore	Shopping Cart	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2187	Oracle iStore	Shopping Cart	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2188	Oracle iStore	Shopping Cart	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2197	Oracle iStore	Shopping Cart	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2150	Oracle iStore	Shopping Cart	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2199	Oracle iStore	Shopping Cart	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2198	Oracle Knowledge Management	Setup, Admin	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2195	Oracle Partner Management	Attribute Admin Setup	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.3, 12.2.3-12.2.10
CVE-2021-2206	Oracle Trade Management	Quotes	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2210	Oracle Trade Management	Quotes	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2247	Oracle Advanced Collections	Admin	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2269	Oracle Advanced Pricing	Price Book	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.3
CVE-2021-2314	Oracle Application Object Library	Profiles	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.3, 12.2.3-12.2.10
CVE-2021-2222	Oracle Bill Presentment Architecture	Template Search	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2288	Oracle Bills of Material	Bill Issues	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3
CVE-2021-2227	Oracle Cash Management	Bank Account Transfer	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3
CVE-2021-2224	Oracle Compensation Workbench	Compensation Workbench	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3
CVE-2021-2295	Oracle Concurrent Processing	BI Publisher Integration	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.3, 12.2.3-12.2.10
CVE-2021-2251	Oracle CRM Technical Foundation	Data Source	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.3, 12.2.3-12.2.10
CVE-2021-2156	Oracle Customers Online	Customer Tab	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.3, 12.2.3-12.2.10
CVE-2021-2229	Oracle Depot Repair	LOVs	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3
CVE-2021-2292	Oracle Document Management and Collaboration	Document Management	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2225	Oracle E-Business Intelligence	DBI Setups	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3
CVE-2021-2274	Oracle E-Business Tax	User Interface	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2290	Oracle Engineering	Change Management	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2233	Oracle Enterprise Asset Management	Setup	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2236	Oracle Financials Common Modules	Advanced Global Intercompany	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3
CVE-2021-2237	Oracle General Ledger	Account Hierarchy Manager	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3
CVE-2021-2316	Oracle HRMS (France)	French HR	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3
CVE-2021-2260	Oracle Human Resources	iRecruitment	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.3
CVE-2021-2228	Oracle Incentive Compensation	User Interface	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.3, 12.2.3-12.2.10
CVE-2021-2231	Oracle Installed Base	APIs	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.3
CVE-2021-2276	Oracle iSetup	General Ledger Update Transform, Reports	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.3, 12.2.3-12.2.10
CVE-2021-2241	Oracle iStore	Shopping Cart	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3
CVE-2021-2267	Oracle Labor Distribution	User Interface	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3
CVE-2021-2249	Oracle Landed Cost Management	Shipment Workbench	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2261	Oracle Lease and Finance Management	Quotes	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2273	Oracle Legal Entity Configurator	Create Contracts	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3
CVE-2021-2252	Oracle Loans	Loan Details, Loan Accounting Events	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3
CVE-2021-2238	Oracle MES for Process Manufacturing	Process Operations	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.3
CVE-2021-2259	Oracle Payables	India Localization, Results	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2289	Oracle Product Hub	Template, GTIN search	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2254	Oracle Project Contracts	Hold Management	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3
CVE-2021-2258	Oracle Projects	User Interface	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2262	Oracle Purchasing	Endeca	HTTPS	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.3
CVE-2021-2268	Oracle Quoting	Courseware	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3
CVE-2021-2223	Oracle Receivables	Receipts	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3
CVE-2021-2255	Oracle Service Contracts	Authoring	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3
CVE-2021-2270	Oracle Site Hub	Sites	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3
CVE-2021-2263	Oracle Sourcing	Intelligence, RFx	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3
CVE-2021-2272	Oracle Subledger Accounting	Inquiries	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3
CVE-2021-2239	Oracle Time and Labor	Timecard	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2235	Oracle Transportation Execution	Install and Upgrade	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3
CVE-2021-2246	Oracle Universal Work Queue	Work Provider Site Level Administration	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.1-12.1.3
CVE-2021-2271	Oracle Work in Process	Resource Exceptions	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	12.1.3, 12.2.3-12.2.8
CVE-2021-2181	Oracle Document Management and Collaboration	Attachments	HTTP	No	7.6	Network	Low	High	None	Changed	High	Low	None	12.1.3, 12.2.3-12.2.10
CVE-2020-1967	Application Server	Technology Stack (OpenSSL)	HTTPS	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	12.1.3
CVE-2021-2189	Oracle Sales Offline	Template	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2190	Oracle Sales Offline	Template	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2275	Oracle Applications Manager	View Reports	HTTP	No	6.5	Network	Low	High	None	Un- changed	High	High	None	12.1.3, 12.2.3-12.2.10
CVE-2017-14735	Oracle E-Business Suite Technology Stack	Attachments, iRecruitment, Contracts (AntiSamy)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	12.1.3, 12.2.3-12.2.10
CVE-2021-2153	Oracle Internet Expenses	Mobile Expenses	HTTP	Yes	4.3	Network	Low	None	Required	Un- changed	None	Low	None	12.2.3-12.2.10
CVE-2021-2155	Oracle One-to-One Fulfillment	Documents	HTTP	Yes	4.3	Network	Low	None	Required	Un- changed	None	Low	None	12.1.1-12.1.3, 12.2.3-12.2.10

Additional patches are included in this Critical Patch Update for the following non-exploitable CVEs in this Oracle product family:

Oracle E-Business Suite Information Discovery
- Installer (Apache Log4j): CVE-2020-9488.

Oracle Enterprise Manager Risk Matrix

This Critical Patch Update contains 9 new security patches for Oracle Enterprise Manager. 8 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. None of these patches are applicable to client-only installations, i.e., installations that do not have Oracle Enterprise Manager installed. The English text form of this Risk Matrix can be found here.

Oracle Enterprise Manager products include Oracle Database and Oracle Fusion Middleware components that are affected by the vulnerabilities listed in the Oracle Database and Oracle Fusion Middleware sections. The exposure of Oracle Enterprise Manager products is dependent on the Oracle Database and Oracle Fusion Middleware versions being used. Oracle Database and Oracle Fusion Middleware security updates are not listed in the Oracle Enterprise Manager risk matrix. However, since vulnerabilities affecting Oracle Database and Oracle Fusion Middleware versions may affect Oracle Enterprise Manager products, Oracle recommends that customers apply the April 2021 Critical Patch Update to the Oracle Database and Oracle Fusion Middleware components of Enterprise Manager. For information on what patches need to be applied to your environments, refer to Critical Patch Update April 2021 Patch Availability Document for Oracle Products, My Oracle Support Note 2749094.1.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2019-17195	Enterprise Manager Base Platform	Enterprise Manager Install (Nimbus JOSE+JWT)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	13.4.0.0
CVE-2019-5064	Oracle Application Testing Suite	Load Testing for Web Apps (OpenCV)	HTTP	Yes	8.8	Network	Low	None	Required	Un- changed	High	High	High	13.3.0.1
CVE-2020-10878	Enterprise Manager Base Platform	EM on Market Place (Perl)	HTTP	Yes	8.6	Network	Low	None	None	Un- changed	Low	Low	High	13.4.0.0
CVE-2020-11994	Enterprise Manager Base Platform	Reporting Framework (Apache Camel)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	High	None	None	13.4.0.0
CVE-2020-1971	Enterprise Manager Ops Center	Satellite Framework (OpenSSL)	HTTPS	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	12.4.0.0
CVE-2021-2008	Enterprise Manager for Fusion Middleware	FMW Control Plugin	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	11.1.1.9, 12.2.1.3
CVE-2019-10086	Enterprise Manager for Virtualization	Administration operations (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	13.4.0.0
CVE-2021-2134	Enterprise Manager for Fusion Middleware	FMW Control Plugin	HTTP	No	6.5	Network	Low	Low	None	Un- changed	None	None	High	12.2.1.4
CVE-2021-2053	Enterprise Manager Base Platform	UI Framework	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	13.4.0.0

Additional CVEs addressed are:

The patch for CVE-2019-5064 also addresses CVE-2019-5063.
The patch for CVE-2020-10878 also addresses CVE-2020-10543 and CVE-2020-12723.
The patch for CVE-2020-1971 also addresses CVE-2021-23839, CVE-2021-23840 and CVE-2021-23841.

Oracle Financial Services Applications Risk Matrix

This Critical Patch Update contains 15 new security patches for Oracle Financial Services Applications. 10 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-11998	Oracle FLEXCUBE Private Banking	Financial Planning (Apache ActiveMQ)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.0.0, 12.1.0
CVE-2020-5413	Oracle FLEXCUBE Private Banking	Order Management (Spring Integration)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.0.0, 12.1.0
CVE-2019-3773	Oracle FLEXCUBE Private Banking	Order Management (Spring Web Services)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.0.0, 12.1.0
CVE-2019-17638	Oracle FLEXCUBE Private Banking	Demographics (Eclipse Jetty)	HTTP	Yes	9.4	Network	Low	None	None	Un- changed	High	High	Low	12.0.0, 12.1.0
CVE-2020-26217	Oracle Banking Platform	Collections (XStream)	HTTP	No	8.8	Network	Low	Low	None	Un- changed	High	High	High	2.4.0, 2.7.1, 2.9.0
CVE-2020-5421	Oracle FLEXCUBE Private Banking	Financial Planning (Spring Framework)	HTTP	No	8.8	Network	Low	Low	None	Un- changed	High	High	High	12.0.0, 12.1.0
CVE-2020-25649	Oracle Banking Platform	Framework (jackson-databind)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	2.6.2, 2.7.0, 2.7.1, 2.8.0, 2.9.0, 2.10.0
CVE-2019-17566	Oracle Financial Services Analytical Applications Infrastructure	Rate Management (Apache Batik)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	8.0.6-8.1.0
CVE-2019-10086	Oracle Banking Platform	Collections (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	2.4.0, 2.7.1, 2.9.0
CVE-2019-10086	Oracle FLEXCUBE Private Banking	Loans and Pledges (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	12.0.0, 12.1.0
CVE-2020-5408	Oracle FLEXCUBE Private Banking	Order Management (Spring Security)	HTTP	No	6.5	Network	Low	Low	None	Un- changed	High	None	None	12.0.0, 12.1.0
CVE-2020-27193	Oracle Banking Platform	Alerts (CKEditor)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	2.4.0, 2.7.0, 2.7.1, 2.8.0, 2.9.0
CVE-2021-2140	Oracle Financial Services Analytical Applications Infrastructure	Rules Framework	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.0.6-8.1.0
CVE-2020-9489	Oracle FLEXCUBE Private Banking	Financial Planning (Apache Tika)	None	No	5.5	Local	Low	None	Required	Un- changed	None	None	High	12.0.0, 12.1.0
CVE-2021-2141	Oracle FLEXCUBE Direct Banking	Pre Login	Oracle Net	No	2.0	Network	High	High	Required	Un- changed	None	Low	None	12.0.2, 12.0.3

Additional CVEs addressed are:

The patch for CVE-2019-10086 also addresses CVE-2020-5413 and CVE-2020-9489.
The patch for CVE-2019-17638 also addresses CVE-2019-17632 and CVE-2020-27218.
The patch for CVE-2019-3773 also addresses CVE-2019-10086, CVE-2020-5413 and CVE-2020-9489.
The patch for CVE-2020-11998 also addresses CVE-2020-11973 and CVE-2020-1941.
The patch for CVE-2020-25649 also addresses CVE-2020-35490, CVE-2020-35491, CVE-2020-35728, CVE-2020-36179, CVE-2020-36180, CVE-2020-36181, CVE-2020-36182, CVE-2020-36183, CVE-2020-36184, CVE-2020-36185, CVE-2020-36186, CVE-2020-36187, CVE-2020-36188 and CVE-2020-36189.
The patch for CVE-2020-27193 also addresses CVE-2020-9281.
The patch for CVE-2020-5408 also addresses CVE-2020-5407.
The patch for CVE-2020-5413 also addresses CVE-2019-10086 and CVE-2020-9489.
The patch for CVE-2020-5421 also addresses CVE-2020-5408.
The patch for CVE-2020-9489 also addresses CVE-2019-10086, CVE-2020-5408 and CVE-2020-5413.

Oracle Food and Beverage Applications Risk Matrix

This Critical Patch Update contains 2 new security patches for Oracle Food and Beverage Applications. 1 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2018-20843	Oracle Hospitality RES 3700	Common (LibExpat)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	5.7.0-5.7.6
CVE-2021-2311	Oracle Hospitality Inventory Management	Export to Reporting and Analytics	HTTP	No	6.5	Network	Low	Low	None	Un- changed	High	None	None	9.1.0

Oracle Fusion Middleware Risk Matrix

This Critical Patch Update contains 45 new security patches for Oracle Fusion Middleware. 36 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

Oracle Fusion Middleware products include Oracle Database components that are affected by the vulnerabilities listed in the Oracle Database section. The exposure of Oracle Fusion Middleware products is dependent on the Oracle Database version being used. Oracle Database security updates are not listed in the Oracle Fusion Middleware risk matrix. However, since vulnerabilities affecting Oracle Database versions may affect Oracle Fusion Middleware products, Oracle recommends that customers apply the Critical Patch Update April 2021 to the Oracle Database components of Oracle Fusion Middleware products. For information on what patches need to be applied to your environments, refer to Critical Patch Update April 2021 Patch Availability Document for Oracle Products, My Oracle Support Note 2749094.1.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-9480	Oracle Business Intelligence Enterprise Edition	Analytics Server (Apache Spark)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	5.5.0.0.0
CVE-2020-10683	Oracle Fusion Middleware	Centralized Thirdparty Jars (dom4j)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.2.1.4.0
CVE-2021-2302	Oracle Platform Security for Java	OPSS	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2020-11612	Oracle WebCenter Portal	Security Framework (Netty)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.2.1.3.0, 12.2.1.4.0
CVE-2021-2136	Oracle WebLogic Server	Core	IIOP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
CVE-2021-2135	Oracle WebLogic Server	Coherence Container	T3, IIOP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
CVE-2019-17638	FMW Platform	Common Components (Eclipse Jetty)	HTTP	Yes	9.4	Network	Low	None	None	Un- changed	High	High	Low	12.2.1.3.0, 12.2.1.4.0
CVE-2020-26217	Oracle BAM (Business Activity Monitoring)	General (XStream)	HTTP	No	8.8	Network	Low	Low	None	Un- changed	High	High	High	11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2020-26217	Oracle Endeca Information Discovery Studio	Studio (XStream)	HTTP	No	8.8	Network	Low	Low	None	Un- changed	High	High	High	3.2.0.0
CVE-2020-5421	Oracle Fusion Middleware	Centralized Thirdparty Jars (Spring Framework)	HTTP	No	8.8	Network	Low	Low	None	Un- changed	High	High	High	12.2.1.3.0, 12.2.1.4.0
CVE-2021-2242	Oracle Outside In Technology	Outside In Filters	HTTP	Yes	8.2	Network	Low	None	None	Un- changed	Low	High	None	8.5.5	See Note 1
CVE-2020-24750	Oracle Identity Manager Connector	General and Misc (jackson-databind)	HTTP	Yes	8.1	Network	High	None	None	Un- changed	High	High	High	11.1.1.5.0
CVE-2020-11979	Oracle API Gateway	Oracle API Gateway (Apache Ant)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	11.1.2.4.0
CVE-2019-17566	Oracle API Gateway	Oracle API Gateway (Apache Batik)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	11.1.2.4.0
CVE-2020-1971	Oracle API Gateway	Oracle API Gateway (OpenSSL)	HTTPS	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	11.1.2.4.0
CVE-2020-1971	Oracle Business Intelligence Enterprise Edition	BI Platform Security (OpenSSL)	HTTPS	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	5.5.0.0.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2021-2277	Oracle Coherence	Core	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	High	None	None	3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
CVE-2020-25649	Oracle Coherence	Core (jackson-databind)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	12.2.1.4.0, 14.1.1.0.0
CVE-2020-11979	Oracle Endeca Information Discovery Studio	Studio (Apache Ant)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	3.2.0.0
CVE-2018-1000180	Oracle Enterprise Repository	Security Subsystem (Bouncy Castle Java Library)	HTTPS	Yes	7.5	Network	Low	None	None	Un- changed	High	None	None	11.1.1.7.0
CVE-2019-17566	Oracle Fusion Middleware MapViewer	Install (Apache Batik)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	12.2.1.4.0
CVE-2020-5360	Oracle HTTP Server	SSL Module (Dell BSAFE Micro Edition Suite)	HTTPS	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2020-5360	Oracle Security Service	C Oracle SSL API (Dell BSAFE Micro Edition Suite)	Multiple	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2019-12402	Oracle WebCenter Portal	Security Framework (Apache Commons Compress)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	12.2.1.3.0, 12.2.1.4.0
CVE-2021-2157	Oracle WebLogic Server	TopLink Integration	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	High	None	None	10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2020-5360	Oracle WebLogic Server Proxy Plug-In	SSL Module (Dell BSAFE Micro Edition Suite)	HTTPS	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2019-10086	Oracle Fusion Middleware	Centralized Thirdparty Jars (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2021-2240	Oracle Outside In Technology	Outside In Filters	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	8.5.5	See Note 1
CVE-2019-10086	Oracle Service Bus	Web Container (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2019-10086	Oracle WebLogic Server	Core (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	10.3.6.0.0
CVE-2019-3740	Oracle WebLogic Server	Core (Dell BSAFE Crypto-J)	HTTPS	Yes	6.5	Network	Low	None	Required	Un- changed	High	None	None	10.3.6.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
CVE-2021-2294	Oracle WebLogic Server	Core	T3, IIOP	Yes	6.5	Network	Low	None	None	Un- changed	None	Low	Low	10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
CVE-2019-0221	Oracle Business Intelligence Enterprise Edition	BI Platform Security (Apache Tomcat)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	5.5.0.0.0
CVE-2020-11022	Oracle Business Intelligence Enterprise Edition	BI Platform Security (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2020-11022	Oracle Fusion Middleware MapViewer	Install (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	12.2.1.4.0
CVE-2021-2142	Oracle WebLogic Server	Console	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	10.3.6.0.0
CVE-2021-2211	Oracle WebLogic Server	Web Services	T3, IIOP	Yes	5.9	Network	High	None	None	Un- changed	High	None	None	10.3.6.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
CVE-2020-27842	Oracle Outside In Technology	Installation (OpenJPEG)	None	No	5.5	Local	Low	None	Required	Un- changed	None	None	High	8.5.5	See Note 1
CVE-2021-20227	Oracle Outside In Technology	Installation (SQLite)	None	No	5.5	Local	Low	Low	None	Un- changed	None	None	High	8.5.5	See Note 1
CVE-2020-9489	Oracle WebCenter Portal	Security Framework (Apache Tika)	None	No	5.5	Local	Low	None	Required	Un- changed	None	None	High	12.2.1.3.0, 12.2.1.4.0
CVE-2021-2191	Oracle Business Intelligence Enterprise Edition	Analytics Actions	HTTP	No	5.4	Network	Low	Low	Required	Changed	Low	Low	None	5.5.0.0.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2021-2315	Oracle HTTP Server	Web Listener	HTTP	Yes	5.4	Network	Low	None	Required	Un- changed	Low	Low	None	11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2021-2204	Oracle WebLogic Server	Core	HTTP	Yes	5.3	Network	Low	None	None	Un- changed	Low	None	None	10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
CVE-2021-2214	Oracle WebLogic Server	Console	HTTP	No	4.4	Network	High	High	None	Un- changed	High	None	None	10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
CVE-2021-2152	Oracle Business Intelligence Enterprise Edition	Analytics Web General	HTTP	No	4.0	Network	High	High	Required	Changed	Low	Low	None	5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0

Notes:

Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS Base Score depend on the software that uses Outside In Technology. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology, but if data is not received over a network the CVSS score may be lower.

Additional CVEs addressed are:

The patch for CVE-2018-1000180 also addresses CVE-2018-1000613.
The patch for CVE-2019-17566 also addresses CVE-2020-11987.
The patch for CVE-2019-17638 also addresses CVE-2019-0232, CVE-2019-10072, CVE-2019-10246, CVE-2019-10247, CVE-2019-17632, CVE-2020-13934, CVE-2020-13935 and CVE-2020-9484.
The patch for CVE-2019-3740 also addresses CVE-2019-3738 and CVE-2019-3739.
The patch for CVE-2020-11022 also addresses CVE-2020-11023.
The patch for CVE-2020-11979 also addresses CVE-2017-5645 and CVE-2020-1945.
The patch for CVE-2020-24750 also addresses CVE-2020-24616.
The patch for CVE-2020-26217 also addresses CVE-2019-10173.
The patch for CVE-2020-27842 also addresses CVE-2020-27841, CVE-2020-27843, CVE-2020-27844 and CVE-2020-27845.
The patch for CVE-2020-5360 also addresses CVE-2020-5359.
The patch for CVE-2021-20227 also addresses CVE-2020-13434 and CVE-2020-13435.

Additional patches are included in this Critical Patch Update for the following non-exploitable CVEs in this Oracle product family:

Oracle WebLogic Server
- Core: CVE-2019-17638, CVE-2019-0232, CVE-2019-10072, CVE-2019-10246, CVE-2019-10247, CVE-2019-17632, CVE-2020-13934, CVE-2020-13935 and CVE-2020-9484.

Oracle Health Sciences Applications Risk Matrix

This Critical Patch Update contains 3 new security patches for Oracle Health Sciences Applications. All of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-1945	Oracle Health Sciences Information Manager	Health Record Locator (Apache Ant)	HTTP	Yes	9.1	Network	Low	None	None	Un- changed	High	High	None	3.0.0-3.0.2
CVE-2020-25649	Oracle Health Sciences Empirica Signal	Topics, REST Services (jackson-databind)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	9.0, 9.1
CVE-2019-10086	Oracle Healthcare Foundation	Self Service Analytics (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	7.1.5, 7.2.2, 7.3.0, 7.3.1, 8.0.1

Additional CVEs addressed are:

The patch for CVE-2020-1945 also addresses CVE-2017-5645.

Oracle Hospitality Applications Risk Matrix

This Critical Patch Update contains 6 new security patches for Oracle Hospitality Applications. 4 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2018-1285	Oracle Hospitality OPERA 5	Logging (Apache log4net)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	5.5, 5.6
CVE-2020-17530	Oracle Hospitality OPERA 5	Login (Apache Struts)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	5.6
CVE-2021-22112	Oracle Hospitality Cruise Shipboard Property Management System	Next-Gen SPMS (Spring Security)	HTTP	No	8.8	Network	Low	Low	None	Un- changed	High	High	High	20.1.0
CVE-2019-17566	Oracle Hospitality OPERA 5	Integration (Apache Batik)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	5.5, 5.6
CVE-2019-10086	Oracle Hospitality OPERA 5	Integrations (Apache Commons Beanutils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	5.5, 5.6
CVE-2020-17521	Oracle Hospitality OPERA 5	Reporting (Apache Groovy)	None	No	5.5	Local	Low	Low	None	Un- changed	High	None	None	5.6, 5.6

Oracle Hyperion Risk Matrix

This Critical Patch Update contains 2 new security patches for Oracle Hyperion. 1 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2021-2244	Hyperion Analytic Provider Services	JAPI	HTTP	Yes	9.6	Network	Low	None	Required	Changed	High	High	High	11.1.2.4, 12.2.1.4
CVE-2021-2158	Hyperion Financial Management	Task Automation	HTTP	No	3.9	Network	High	High	Required	Un- changed	Low	Low	Low	11.1.2.4

Oracle iLearning Risk Matrix

This Critical Patch Update contains 1 new security patch for Oracle iLearning. This vulnerability is not remotely exploitable without authentication, i.e., may not be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-17521	Oracle iLearning	Installation (Apache Groovy)	None	No	5.5	Local	Low	Low	None	Un- changed	High	None	None	6.2, 6.3

Oracle Insurance Applications Risk Matrix

This Critical Patch Update contains 1 new security patch for Oracle Insurance Applications. This vulnerability is remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2019-10086	Oracle Insurance Data Gateway	Security (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	1.0.2.3

Oracle Java SE Risk Matrix

This Critical Patch Update contains 4 new security patches for Oracle Java SE. All of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2021-23841	Oracle GraalVM Enterprise Edition	Node (OpenSSL)	HTTPS	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1.2, 21.0.0.2
CVE-2021-3450	Oracle GraalVM Enterprise Edition	Node (Node.js)	HTTPS	Yes	7.4	Network	High	None	None	Un- changed	High	High	None	Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1.2, 21.0.0.2
CVE-2021-2161	Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition	Libraries	Multiple	Yes	5.9	Network	High	None	None	Un- changed	None	High	None	Java SE: 7u291, 8u281, 11.0.10, 16; Java SE Embedded: 8u281; Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1.2, 21.0.0.2	See Note 1
CVE-2021-2163	Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition	Libraries	Multiple	Yes	5.3	Network	High	None	Required	Un- changed	None	High	None	Java SE: 7u291, 8u281, 11.0.10, 16; Java SE Embedded: 8u281; Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1.2, 21.0.0.2	See Note 2

Notes:

This vulnerability applies to Java deployments that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. It can also be exploited by supplying untrusted data to APIs in the specified Component.
This vulnerability applies to Java deployments that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security.

Additional CVEs addressed are:

The patch for CVE-2021-23841 also addresses CVE-2021-23839 and CVE-2021-23840.
The patch for CVE-2021-3450 also addresses CVE-2020-7774, CVE-2021-22883, CVE-2021-22884 and CVE-2021-3449.

Oracle JD Edwards Risk Matrix

This Critical Patch Update contains 10 new security patches for Oracle JD Edwards. All of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-28052	JD Edwards EnterpriseOne Tools	E1 Dev Platform Tech – Cloud (Bouncy Castle Java Library)	HTTPS	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	Prior to 9.2.5.3
CVE-2019-17566	JD Edwards EnterpriseOne Tools	Web Runtime (Apache Batik)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	Prior to 9.2.4.0
CVE-2020-1971	JD Edwards EnterpriseOne Tools	OneWorld Tools Security (OpenSSL)	HTTPS	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	Prior to 9.2.5.3
CVE-2020-1971	JD Edwards World Security	World Software Security (OpenSSL)	HTTPS	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	A9.4
CVE-2019-10086	JD Edwards EnterpriseOne Orchestrator	E1 IOT Orchestrator Security (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	Prior to 9.2.5.3
CVE-2019-10086	JD Edwards EnterpriseOne Tools	Portal SEC (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	Prior to 9.2.5.3
CVE-2020-9281	JD Edwards EnterpriseOne Tools	Web Runtime (CKEditor)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	Prior to 9.2.5.2
CVE-2020-11022	JD Edwards EnterpriseOne Tools	Web Runtime (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	Prior to 9.2.5.0
CVE-2016-5725	JD Edwards EnterpriseOne Tools	Enterprise Infrastructure SEC (JCraft JSch)	SFTP	Yes	5.9	Network	High	None	None	Un- changed	None	High	None	Prior to 9.2.5.0
CVE-2020-9488	JD Edwards World Security	World Software Security (Apache Log4j)	HTTP	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	A9.4

Additional CVEs addressed are:

The patch for CVE-2020-11022 also addresses CVE-2019-11358 and CVE-2019-5428.
The patch for CVE-2020-1971 also addresses CVE-2019-1551, CVE-2020-1967, CVE-2020-1968 and CVE-2020-9488.

Oracle MySQL Risk Matrix

This Critical Patch Update contains 49 new security patches for Oracle MySQL. 10 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-17530	MySQL Enterprise Monitor	Monitoring: General (Apache Struts)	HTTPS	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	8.0.23 and prior
CVE-2020-8277	MySQL Cluster	Cluster: JS module (Node.js)	Multiple	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	8.0.23 and prior
CVE-2020-17527	MySQL Enterprise Monitor	Monitoring: General (Apache Tomcat)	Apache JServ Protocol (AJP)	Yes	7.5	Network	Low	None	None	Un- changed	High	None	None	8.0.23 and prior
CVE-2021-23841	MySQL Enterprise Monitor	Monitoring: General (OpenSSL)	HTTPS	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	8.0.23 and prior
CVE-2020-1971	MySQL Server	Server: Compiling (OpenSSL)	MySQL Protocol	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	5.7.32 and prior, 8.0.22 and prior
CVE-2021-3449	MySQL Server	Server: Packaging (OpenSSL)	MySQL Protocol	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	5.7.33 and prior, 8.0.23 and prior
CVE-2020-28196	MySQL Server	Server: Security: Encryption (MIT Kerberos)	MySQL Protocol	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	8.0.23 and prior
CVE-2021-23841	MySQL Server	Server: Security: Encryption (OpenSSL)	MySQL Protocol	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	5.7.33 and prior, 8.0.23 and prior
CVE-2021-3450	MySQL Workbench	MySQL Workbench (OpenSSL)	MySQL Workbench	Yes	7.4	Network	High	None	None	Un- changed	High	High	None	8.0.23 and prior
CVE-2021-2144	MySQL Server	Server: Parser	MySQL Protocol	No	7.2	Network	Low	High	None	Un- changed	High	High	High	5.7.29 and prior, 8.0.19 and prior
CVE-2021-2172	MySQL Server	Server: DML	MySQL Protocol	No	6.5	Network	Low	Low	None	Un- changed	None	None	High	8.0.23 and prior
CVE-2021-2298	MySQL Server	Server: Optimizer	MySQL Protocol	No	6.5	Network	Low	Low	None	Un- changed	None	None	High	8.0.23 and prior
CVE-2021-2178	MySQL Server	Server: Replication	MySQL Protocol	No	6.5	Network	Low	Low	None	Un- changed	None	None	High	5.7.32 and prior, 8.0.22 and prior
CVE-2021-2202	MySQL Server	Server: Replication	MySQL Protocol	No	6.5	Network	Low	Low	None	Un- changed	None	None	High	5.7.32 and prior, 8.0.22 and prior
CVE-2021-2307	MySQL Server	Server: Packaging	None	No	6.1	Local	Low	None	Required	Un- changed	High	Low	None	5.7.33 and prior, 8.0.23 and prior
CVE-2021-2304	MySQL Server	Server: Stored Procedure	MySQL Protocol	No	5.5	Network	Low	High	None	Un- changed	None	Low	High	8.0.23 and prior
CVE-2019-7317	MySQL Workbench	Workbench (libpng)	MySQL Workbench	Yes	5.3	Network	High	None	Required	Un- changed	None	None	High	8.0.23 and prior
CVE-2021-2180	MySQL Server	InnoDB	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	5.7.33 and prior, 8.0.23 and prior
CVE-2021-2194	MySQL Server	InnoDB	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	5.7.33 and prior, 8.0.23 and prior
CVE-2021-2154	MySQL Server	Server: DML	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	5.7.33 and prior
CVE-2021-2166	MySQL Server	Server: DML	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	5.7.33 and prior, 8.0.23 and prior
CVE-2021-2196	MySQL Server	Server: DML	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.23 and prior
CVE-2021-2300	MySQL Server	Server: DML	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.23 and prior
CVE-2021-2305	MySQL Server	Server: DML	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.23 and prior
CVE-2021-2179	MySQL Server	Server: Group Replication Plugin	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	5.7.33 and prior, 8.0.23 and prior
CVE-2021-2226	MySQL Server	Server: Information Schema	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	High	None	None	5.7.33 and prior, 8.0.23 and prior
CVE-2021-2160	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	5.7.30 and prior, 8.0.17 and prior
CVE-2021-2164	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.23 and prior
CVE-2021-2169	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	5.7.33 and prior, 8.0.23 and prior
CVE-2021-2170	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.23 and prior
CVE-2021-2193	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.23 and prior
CVE-2021-2203	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.23 and prior
CVE-2021-2212	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.23 and prior
CVE-2021-2213	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.22 and prior
CVE-2021-2278	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.23 and prior
CVE-2021-2299	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.23 and prior
CVE-2021-2230	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.23 and prior
CVE-2021-2146	MySQL Server	Server: Options	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	5.7.33 and prior, 8.0.23 and prior
CVE-2021-2201	MySQL Server	Server: Partition	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.23 and prior
CVE-2021-2208	MySQL Server	Server: Partition	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.23 and prior
CVE-2021-2215	MySQL Server	Server: Stored Procedure	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.23 and prior
CVE-2021-2217	MySQL Server	Server: Stored Procedure	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.23 and prior
CVE-2021-2293	MySQL Server	Server: Stored Procedure	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.23 and prior
CVE-2021-2174	MySQL Server	InnoDB	MySQL Protocol	No	4.4	Network	High	High	None	Un- changed	None	None	High	5.7.33 and prior, 8.0.23 and prior
CVE-2021-2171	MySQL Server	Server: Replication	MySQL Protocol	No	4.4	Network	High	High	None	Un- changed	None	None	High	5.7.33 and prior, 8.0.23 and prior
CVE-2021-2162	MySQL Server	Server: Audit Plug-in	MySQL Protocol	No	4.3	Network	Low	Low	None	Un- changed	None	Low	None	5.7.33 and prior, 8.0.23 and prior
CVE-2021-2301	MySQL Server	Server: Information Schema	MySQL Protocol	No	2.7	Network	Low	High	None	Un- changed	Low	None	None	8.0.23 and prior
CVE-2021-2308	MySQL Server	Server: Information Schema	MySQL Protocol	No	2.7	Network	Low	High	None	Un- changed	Low	None	None	8.0.23 and prior
CVE-2021-2232	MySQL Server	Server: Group Replication Plugin	None	No	1.9	Local	High	High	None	Un- changed	None	None	Low	8.0.23 and prior

Additional CVEs addressed are:

The patch for CVE-2019-7317 also addresses CVE-2018-14550.
The patch for CVE-2020-17530 also addresses CVE-2019-0230 and CVE-2019-0233.
The patch for CVE-2021-23841 also addresses CVE-2021-23840.
The patch for CVE-2021-3449 also addresses CVE-2021-3450.
The patch for CVE-2021-3450 also addresses CVE-2021-3449.

Oracle PeopleSoft Risk Matrix

This Critical Patch Update contains 18 new security patches plus additional third party patches noted below for Oracle PeopleSoft. 13 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2021-2218	PeopleSoft Enterprise PT PeopleTools	Health Center	HTTP	Yes	8.3	Network	Low	None	None	Changed	Low	Low	Low	8.56, 8.57
CVE-2020-28052	PeopleSoft Enterprise PeopleTools	XML Messaging (Bouncy Castle Java Library)	HTTPS	Yes	8.1	Network	High	None	None	Un- changed	High	High	High	8.56, 8.57, 8.58
CVE-2020-8286	PeopleSoft Enterprise PeopleTools	File Processing (cURL)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	8.58
CVE-2017-18640	PeopleSoft Enterprise PT PeopleTools	Application Server (SnakeYAML)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	8.56, 8.57, 8.58
CVE-2021-2219	PeopleSoft Enterprise PeopleTools	SQR	HTTP	No	7.4	Network	Low	Low	None	Changed	Low	Low	Low	8.56, 8.57, 8.58
CVE-2019-10086	PeopleSoft Enterprise PT PeopleTools	Weblogic (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	8.56, 8.57, 8.58
CVE-2017-1000061	PeopleSoft Enterprise PeopleTools	XML Messaging (xmlSec)	None	No	7.1	Local	Low	None	Required	Un- changed	High	None	High	8.56, 8.57, 8.58
CVE-2021-2151	PeopleSoft Enterprise PeopleTools	Security	HTTP	No	6.7	Network	Low	High	None	Un- changed	Low	High	High	8.56, 8.57, 8.58
CVE-2020-11022	PeopleSoft Enterprise FIN Common Application Objects	Common Objects (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	9.2
CVE-2020-11022	PeopleSoft Enterprise FIN Expenses	Expenses (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	9.2
CVE-2021-2216	PeopleSoft Enterprise PeopleTools	Multichannel Framework	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.56, 8.57, 8.58
CVE-2020-27193	PeopleSoft Enterprise PeopleTools	Rich Text Editor (CKEditor)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.56, 8.57, 8.58
CVE-2020-11022	PeopleSoft Enterprise PT PeopleTools	Weblogic (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.56, 8.57, 8.58
CVE-2020-11022	PeopleSoft Enterprise SCM eProcurement	Manage Requisition Status (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	9.2
CVE-2020-11022	PeopleSoft Enterprise SCM Purchasing	Purchasing (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	9.2
CVE-2020-1971	PeopleSoft Enterprise PeopleTools	Security (OpenSSL)	HTTPS	Yes	5.9	Network	High	None	None	Un- changed	None	None	High	8.56, 8.57, 8.58
CVE-2021-2220	PeopleSoft Enterprise SCM eProcurement	Manage Requisition Status	HTTP	No	5.4	Network	Low	Low	None	Un- changed	Low	Low	None	9.2
CVE-2021-2159	PeopleSoft Enterprise CS Campus Community	Frameworks	HTTP	No	3.5	Network	Low	Low	Required	Un- changed	Low	None	None	9.2

Additional CVEs addressed are:

The patch for CVE-2017-18640 also addresses CVE-2019-12402.
The patch for CVE-2020-11022 also addresses CVE-2020-11023.
The patch for CVE-2020-8286 also addresses CVE-2020-8284 and CVE-2020-8285.

Additional patches are included in this Critical Patch Update for the following non-exploitable CVEs in this Oracle product family:

PeopleSoft Enterprise PeopleTools
- Security (Apache Log4j): CVE-2019-17571.

Oracle Retail Applications Risk Matrix

This Critical Patch Update contains 35 new security patches for Oracle Retail Applications. 31 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-10683	Oracle Retail Xstore Point of Service	Xenvironment (dom4j)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	15.0.4, 16.0.6, 17.0.4, 18.0.3
CVE-2019-0228	Oracle Retail Xstore Point of Service	Xstore Office (Apache PDFbox)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	16.0.6, 18.0.3
CVE-2020-5421	Oracle Retail Predictive Application Server	RPAS Fusion Client (Spring Framework)	HTTP	No	8.8	Network	Low	Low	None	Un- changed	High	High	High	14.1
CVE-2020-5421	Oracle Retail Xstore Point of Service	Xenvironment (Spring Framework)	HTTP	No	8.8	Network	Low	Low	None	Un- changed	High	High	High	15.0.4, 16.0.6, 17.0.4, 18.0.3, 19.0.2,
CVE-2020-11979	Oracle Retail Advanced Inventory Planning	Operations & Maintenance (Apache Ant)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	14.1
CVE-2020-11979	Oracle Retail Assortment Planning	Custom Workbooks (Apache Ant)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	16.0.3
CVE-2020-11987	Oracle Retail Back Office	Pricing (Apache Batik)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	14.1
CVE-2020-11979	Oracle Retail Category Management Planning & Optimization	ODI Integration (Apache Ant)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	16.0.3
CVE-2020-11987	Oracle Retail Central Office	Pricing (Apache Batik)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	14.1
CVE-2020-11979	Oracle Retail EFTLink	Unified Payments (Apache Ant)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	19.0.1, 20.0.0
CVE-2020-11979	Oracle Retail Item Planning	AAI Framework (Apache Ant)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	16.0.3
CVE-2020-11979	Oracle Retail Macro Space Optimization	ODI Integration (Apache Ant)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	16.0.3
CVE-2020-11979	Oracle Retail Merchandise Financial Planning	Merchandising Insights (Apache Ant)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	16.0.3
CVE-2020-11979	Oracle Retail Merchandising System	Financials (Apache Ant)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	16.0.3
CVE-2020-11987	Oracle Retail Point-of-Service	Mobile POS (Apache Batik)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	14.1
CVE-2020-11979	Oracle Retail Predictive Application Server	RPAS Fusion Client (Apache Ant)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	14.1
CVE-2020-11979	Oracle Retail Regular Price Optimization	Operations & Maintenance (Apache Ant)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	16.0.3
CVE-2020-11979	Oracle Retail Replenishment Optimization	AAI Framework (Apache Ant)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	16.0.3
CVE-2020-11987	Oracle Retail Returns Management	Main Dashboard (Apache Batik)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	14.1
CVE-2017-12626	Oracle Retail Sales Audit	Sales Audit Maintenance (Apache POI)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	14.0
CVE-2020-11979	Oracle Retail Size Profile Optimization	Solver (Apache Ant)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	16.0.3
CVE-2020-11979	Oracle Retail Xstore Point of Service	Xenvironment (Apache Ant)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	15.0.4, 16.0.6, 17.0.4, 18.0.3, 19.0.2
CVE-2019-10086	Oracle Retail Advanced Inventory Planning	Operations & Maintenance (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	14.1
CVE-2019-10086	Oracle Retail Back Office	Pricing (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	14.1
CVE-2019-10086	Oracle Retail Central Office	Commerce Anywhere (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	14.1
CVE-2019-10086	Oracle Retail Point-of-Service	Pricing (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	14.1
CVE-2019-10086	Oracle Retail Predictive Application Server	RPAS Fusion Client (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	16.0
CVE-2019-10086	Oracle Retail Returns Management	Main Dashboard (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	14.1
CVE-2019-3740	Oracle Retail Predictive Application Server	RPAS Server (DELL BSAFE Crypto-J)	HTTPS	Yes	6.5	Network	Low	None	Required	Un- changed	High	None	None	15.0
CVE-2020-17521	Oracle Retail Merchandising System	Foundation (Apache Groovy)	None	No	5.5	Local	Low	Low	None	Un- changed	High	None	None	16.0.3
CVE-2020-17521	Oracle Retail Store Inventory Management	SIM Integration (Apache Groovy)	None	No	5.5	Local	Low	Low	None	Un- changed	High	None	None	14.1.3.10, 15.0.3.5, 16.0.3.5
CVE-2020-27218	Oracle Retail EFTLink	Unified Payments (Eclipse Jetty)	HTTP	Yes	4.8	Network	High	None	None	Un- changed	None	Low	Low	20.0.0
CVE-2020-9488	Oracle Retail EFTLink	Unified Payments (Apache Log4j)	HTTP	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	15.0.2, 16.0.3, 17.0.2, 18.0.1, 19.0.1
CVE-2020-9488	Oracle Retail Insights Cloud Service Suite	OBIEE – Metadata (Apache Log4j)	HTTP	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	19.0
CVE-2020-9488	Oracle Retail Xstore Point of Service	Xenvironment (Apache Log4j)	HTTP	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	15.0.4, 16.0.6, 17.0.4, 18.0.3, 19.0.2

Additional CVEs addressed are:

The patch for CVE-2020-11979 also addresses CVE-2017-5645 and CVE-2020-1945.
The patch for CVE-2020-11987 also addresses CVE-2019-17566.

Oracle Siebel CRM Risk Matrix

This Critical Patch Update contains 8 new security patches for Oracle Siebel CRM. 7 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-14195	Siebel UI Framework	EAI (jackson-databind)	HTTP	Yes	8.1	Network	High	None	None	Un- changed	High	High	High	21.2 and prior
CVE-2020-5398	Siebel Engineering – Installer & Deployment	Siebel Approval Manager (Spring Framework)	HTTP	Yes	7.5	Network	High	None	Required	Un- changed	High	High	High	21.1 and prior
CVE-2019-0227	Siebel UI Framework	SWSE Server (Apache Axis)	HTTP	Yes	7.5	Adjacent Network	High	None	None	Un- changed	High	High	High	21.0 and prior
CVE-2019-10080	Siebel UI Framework	EAI (Jersey)	HTTP	No	6.5	Network	Low	Low	None	Un- changed	High	None	None	21.2 and prior
CVE-2020-9281	Siebel Apps – Customer Order Management	Customizable Prod/Configurator (CKEditor)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	21.0 and prior
CVE-2016-7103	Siebel UI Framework	UIF Open UI (jQuery UI)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	21.2 and prior
CVE-2019-11358	Siebel UI Framework	UIF Open UI (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	21.2 and prior
CVE-2020-9488	Siebel UI Framework	EAI (Apache Log4j)	HTTP	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	21.2 and prior

Additional CVEs addressed are:

The patch for CVE-2019-0227 also addresses CVE-2018-8032.
The patch for CVE-2020-14195 also addresses CVE-2020-14060, CVE-2020-14061, CVE-2020-14062, CVE-2020-24616 and CVE-2020-24750.

Oracle Storage Gateway Risk Matrix

This Critical Patch Update contains 6 new security patches for Oracle Storage Gateway. 2 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2021-2317	Oracle Cloud Infrastructure Storage Gateway	Management Console	HTTP	Yes	10.0	Network	Low	None	None	Changed	High	High	High	Prior to 1.4	See Note 1
CVE-2021-2256	Oracle Storage Cloud Software Appliance	Management Console	HTTP	Yes	10.0	Network	Low	None	None	Changed	High	High	High	Prior to 16.3.1.4.2	See Note 2
CVE-2021-2318	Oracle Cloud Infrastructure Storage Gateway	Management Console	HTTP	No	9.1	Network	Low	High	None	Changed	High	High	High	Prior to 1.4	See Note 1
CVE-2021-2319	Oracle Cloud Infrastructure Storage Gateway	Management Console	HTTP	No	9.1	Network	Low	High	None	Changed	High	High	High	Prior to 1.4	See Note 1
CVE-2021-2320	Oracle Cloud Infrastructure Storage Gateway	Management Console	HTTP	No	9.1	Network	Low	High	None	Changed	High	High	High	Prior to 1.4	See Note 1
CVE-2021-2257	Oracle Storage Cloud Software Appliance	Management Console	HTTP	No	4.1	Network	Low	High	None	Changed	Low	None	None	Prior to 16.3.1.4.2	See Note 2

Notes:

Updating the Oracle Cloud Infrastructure Storage Gateway to version 1.4 or later will address these vulnerabilities. Download the latest version of Oracle Cloud Infrastructure Storage Gateway from here. Refer to Document 2768897.1 for more details.
Updating the Oracle Storage Cloud Software Appliance to version 16.3.1.4.2 or later will address these vulnerabilities. Download the latest version of Oracle Storage Cloud Software Appliance from here. Refer to Document 2768897.1 for more details.

Oracle Supply Chain Risk Matrix

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2019-2904	Oracle Rapid Planning	User interface (Application Development Framework)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.1.3
CVE-2021-2253	Oracle Advanced Supply Chain Planning	Core	HTTP	Yes	9.1	Network	Low	None	None	Un- changed	High	High	None	12.1, 12.2
CVE-2019-10086	Agile Product Lifecycle Management Integration Pack for Oracle E-Business Suite	Installer (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	3.5, 3.6
CVE-2019-10086	Agile Product Lifecycle Management Integration Pack for SAP: Design to Release	Core (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	3.5, 3.6
CVE-2019-10086	Oracle Agile PLM	Security (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	9.3.3, 9.3.5, 9.3.6

Oracle Support Tools Risk Matrix

This Critical Patch Update contains 1 new security patch for Oracle Support Tools. This vulnerability is not remotely exploitable without authentication, i.e., may not be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2021-2303	OSS Support Tools	Diagnostic Assistant	HTTP	No	4.9	Network	Low	High	None	Un- changed	High	None	None	Prior to 2.12.41

Oracle Systems Risk Matrix

This Critical Patch Update contains 5 new security patches for Oracle Systems. 1 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-1472	Oracle ZFS Storage Appliance Kit	Operating System Image	Multiple	Yes	10.0	Network	Low	None	None	Changed	High	High	High	8.8
CVE-2021-2167	Oracle Solaris	Common Desktop Environment	None	No	7.8	Local	Low	Low	None	Un- changed	High	High	High	10
CVE-2021-2192	Oracle Solaris	Kernel	None	No	6.1	Local	Low	Low	None	Un- changed	None	Low	High	11	See Note 1
CVE-2021-2149	Oracle ZFS Storage Appliance Kit	Core	None	No	2.5	Local	High	Low	None	Un- changed	None	Low	None	8.8
CVE-2021-2147	Oracle ZFS Storage Appliance Kit	Installation	None	No	1.8	Local	High	High	Required	Un- changed	None	Low	None	8.8

Notes:

This vulnerability applies to Oracle Solaris on SPARC systems only.

Additional CVEs addressed are:

The patch for CVE-2020-1472 also addresses CVE-2020-26418, CVE-2020-26419, CVE-2020-26420, CVE-2020-26421, CVE-2020-26422, CVE-2021-22173, CVE-2021-22174, CVE-2021-22191 and CVE-2021-23336.

Oracle Utilities Applications Risk Matrix

This Critical Patch Update contains 5 new security patches for Oracle Utilities Applications. All of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2019-17495	Oracle Utilities Framework	General (Swagger UI)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0
CVE-2020-28052	Oracle Utilities Framework	Securty (Bouncy Castle Java Library)	HTTPS	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0
CVE-2020-11979	Oracle Utilities Framework	General (Apache Ant)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	4.3.0.5.0, 4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0
CVE-2020-25649	Oracle Utilities Framework	General (jackson-databind)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	4.3.0.5.0, 4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0
CVE-2019-10086	Oracle Utilities Framework	General (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0-4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0

Oracle Virtualization Risk Matrix

This Critical Patch Update contains 25 new security patches for Oracle Virtualization. 5 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2021-2177	Oracle Secure Global Desktop	Gateway	Multiple	Yes	10.0	Network	Low	None	None	Changed	High	High	High	5.6
CVE-2021-2248	Oracle Secure Global Desktop	Server	Multiple	Yes	10.0	Network	Low	None	None	Changed	High	High	High	5.6
CVE-2021-2221	Oracle Secure Global Desktop	Client	Multiple	Yes	9.6	Network	Low	None	Required	Changed	High	High	High	5.6
CVE-2021-2264	Oracle VM VirtualBox	Core	None	No	8.4	Local	Low	Low	None	Changed	High	High	None	Prior to 6.1.20	See Note 1
CVE-2021-2279	Oracle VM VirtualBox	Core	RDP	Yes	8.1	Network	High	None	None	Un- changed	High	High	High	Prior to 6.1.20
CVE-2021-2309	Oracle VM VirtualBox	Core	None	No	7.5	Local	High	High	None	Changed	High	High	High	Prior to 6.1.20
CVE-2021-2250	Oracle VM VirtualBox	Core	None	No	7.5	Local	High	High	None	Changed	High	High	High	Prior to 6.1.20	See Note 2
CVE-2021-2145	Oracle VM VirtualBox	Core	None	No	7.5	Local	High	High	None	Changed	High	High	High	Prior to 6.1.20
CVE-2021-2310	Oracle VM VirtualBox	Core	None	No	7.5	Local	High	High	None	Changed	High	High	High	Prior to 6.1.20
CVE-2021-3450	Oracle Secure Global Desktop	Core (OpenSSL)	HTTPS	Yes	7.4	Network	High	None	None	Un- changed	High	High	None	5.6
CVE-2021-2280	Oracle VM VirtualBox	Core	None	No	7.1	Local	Low	None	None	Changed	High	None	None	Prior to 6.1.20
CVE-2021-2281	Oracle VM VirtualBox	Core	None	No	7.1	Local	Low	None	None	Changed	None	High	None	Prior to 6.1.20
CVE-2021-2282	Oracle VM VirtualBox	Core	None	No	7.1	Local	Low	None	None	Changed	High	None	None	Prior to 6.1.20
CVE-2021-2283	Oracle VM VirtualBox	Core	None	No	7.1	Local	Low	None	None	Changed	High	None	None	Prior to 6.1.20
CVE-2021-2284	Oracle VM VirtualBox	Core	None	No	7.1	Local	Low	None	None	Changed	None	High	None	Prior to 6.1.20
CVE-2021-2285	Oracle VM VirtualBox	Core	None	No	7.1	Local	Low	None	None	Changed	High	None	None	Prior to 6.1.20
CVE-2021-2286	Oracle VM VirtualBox	Core	None	No	7.1	Local	Low	None	None	Changed	None	High	None	Prior to 6.1.20
CVE-2021-2287	Oracle VM VirtualBox	Core	None	No	7.1	Local	Low	None	None	Changed	High	None	None	Prior to 6.1.20
CVE-2021-2306	Oracle VM VirtualBox	Core	None	No	6.0	Local	Low	High	None	Changed	High	None	None	Prior to 6.1.20
CVE-2021-2266	Oracle VM VirtualBox	Core	None	No	6.0	Local	Low	High	None	Changed	High	None	None	Prior to 6.1.20
CVE-2021-2321	Oracle VM VirtualBox	Core	None	No	6.0	Local	Low	High	None	Changed	High	None	None	Prior to 6.1.20
CVE-2021-2296	Oracle VM VirtualBox	Core	None	No	5.3	Local	High	High	None	Changed	High	None	None	Prior to 6.1.20
CVE-2021-2297	Oracle VM VirtualBox	Core	None	No	5.3	Local	High	High	None	Changed	High	None	None	Prior to 6.1.20
CVE-2021-2291	Oracle VM VirtualBox	Core	None	No	4.7	Local	High	Low	None	Un- changed	High	None	None	Prior to 6.1.20
CVE-2021-2312	Oracle VM VirtualBox	Core	None	No	4.4	Local	Low	High	None	Un- changed	None	None	High	Prior to 6.1.20	See Note 2

Notes:

This vulnerability applies to Linux systems only.
This vulnerability applies to Windows systems only.

Additional CVEs addressed are:

The patch for CVE-2021-3450 also addresses CVE-2021-3449.

No Related Posts

Oracle Critical Patch Update Advisory – January 2021

January 18, 2021September 28, 2021 Oracle Leave a comment

Oracle Critical Patch Update Advisory – January 2021

Description

This Critical Patch Update contains 329 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at January 2021 Critical Patch Update: Executive Summary and Analysis.

Please note that since the release of the October 2020 Critical Patch Update, Oracle has released a Security Alert for Oracle WebLogic Server: CVE-2020-14750 (November 1, 2020). Customers are strongly advised to apply this Critical Patch Update, which includes patches for this Alert as well as additional patches.

Affected Products and Patch Information

Security vulnerabilities addressed by this Critical Patch Update affect the products listed below. The product area is shown in the Patch Availability Document column.

Please click on the links in the Patch Availability Document column below to access the documentation for patch availability information and installation instructions.

Affected Products and Versions	Patch Availability Document
Business Intelligence Enterprise Edition, versions 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Enterprise Manager Base Platform, versions 13.2.1.0, 13.3.0.0, 13.4.0.0	Enterprise Manager
Enterprise Manager for Fusion Applications, version 13.3.0.0	Enterprise Manager
Enterprise Manager Ops Center, version 12.4.0.0	Enterprise Manager
Hyperion Financial Reporting, version 11.1.2.4	Fusion Middleware
Hyperion Infrastructure Technology, version 11.1.2.4	Fusion Middleware
Instantis EnterpriseTrack, versions 17.1-17.3	Oracle Construction and Engineering Suite
JD Edwards EnterpriseOne Orchestrator, versions prior to 9.2.5.1	JD Edwards
JD Edwards EnterpriseOne Tools, versions prior to 9.2.5.0	JD Edwards
MySQL Client, versions 5.6.50 and prior, 5.7.32 and prior, 8.0.22 and prior	MySQL
MySQL Enterprise Monitor, versions 8.0.22 and prior	MySQL
MySQL Server, versions 5.6.50 and prior, 5.7.32 and prior, 8.0.22 and prior	MySQL
MySQL Workbench, versions 8.0.22 and prior	MySQL
Oracle Adaptive Access Manager, version 11.1.2.3.0	Fusion Middleware
Oracle Agile Engineering Data Management, version 6.2.1.0	Oracle Supply Chain Products
Oracle Agile PLM, versions 9.3.5, 9.3.6	Oracle Supply Chain Products
Oracle Agile Product Lifecycle Management for Process, version 6.1	Oracle Supply Chain Products
Oracle Application Express Opportunity Tracker, versions prior to 20.2	Database
Oracle Application Express Survey Builder, versions prior to 20.2	Database
Oracle Application Testing Suite, version 13.3.0.1	Enterprise Manager
Oracle Argus Safety, version 8.2.2	Health Sciences
Oracle BAM (Business Activity Monitoring), versions 11.1.1.9.0, 12.2.1.3.0	Fusion Middleware
Oracle Banking Corporate Lending Process Management, versions 14.1.0, 14.3.0, 14.4.0	Oracle Financial Services Applications
Oracle Banking Credit Facilities Process Management, versions 14.1.0, 14.3.0, 14.4.0	Oracle Financial Services Applications
Oracle Banking Extensibility Workbench, versions 14.3.0, 14.4.0	Oracle Financial Services Applications
Oracle Banking Liquidity Management, versions 14.0.0-14.4.0	Oracle Financial Services Applications
Oracle Banking Payments, version 14.4.0	Oracle Financial Services Applications
Oracle Banking Platform, versions 2.4.0, 2.4.1, 2.6.2, 2.7.0, 2.7.1, 2.8.0, 2.9.0	Oracle Banking Platform
Oracle Banking Supply Chain Finance, versions 14.2.0-14.4.0	Oracle Financial Services Applications
Oracle Banking Trade Finance Process Management, versions 14.1.0, 14.3.0, 14.4.0	Oracle Financial Services Applications
Oracle Banking Virtual Account Management, versions 14.1.0, 14.3.0, 14.4.0	Oracle Financial Services Applications
Oracle BI Publisher, versions 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Oracle Business Intelligence Enterprise Edition, versions 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Oracle Business Process Management Suite, versions 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Oracle Coherence, versions 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0	Fusion Middleware
Oracle Communications Application Session Controller, version 3.9m0p2	Oracle Communications Application Session Controller
Oracle Communications ASAP, version 7.3	Oracle Communications ASAP
Oracle Communications BRM – Elastic Charging Engine, versions 11.3.0.9, 12.0.0.3	Oracle Communications BRM – Elastic Charging Engine
Oracle Communications Calendar Server, version 8.0.0.4.0	Oracle Communications Calendar Server
Oracle Communications Contacts Server, version 8.0.0.5.0	Oracle Communications Contacts Server
Oracle Communications Diameter Signaling Router (DSR), versions 8.0.0-8.2.2	Oracle Communications Diameter Signaling Router
Oracle Communications Element Manager, versions 8.2.1.0-8.2.2.1	Oracle Communications Element Manager
Oracle Communications MetaSolv Solution, versions 6.3.0-6.3.1	Oracle Communications MetaSolv Solution
Oracle Communications Network Charging and Control, versions 6.0.1, 12.0.2	Oracle Communications Network Charging and Control
Oracle Communications Operations Monitor, versions 3.4, 4.1, 4.2, 4.3	Oracle Communications Operations Monitor
Oracle Communications Performance Intelligence Center (PIC) Software, version 10.4.0.2	Oracle Communications Performance Intelligence Center (PIC) Software
Oracle Communications Session Report Manager, versions 8.2.1.0-8.2.2.1	Oracle Communications Session Report Manager
Oracle Complex Maintenance, Repair, and Overhaul, versions 11.5.10, 12.1, 12.2	Oracle Supply Chain Products
Oracle Configurator, versions 12.1, 12.2	Oracle Supply Chain Products
Oracle Data Integrator, versions 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Oracle Database Server, versions 12.1.0.2, 12.2.0.1, 18c, 19c	Database
Oracle E-Business Suite, versions 12.1.1-12.1.3, 12.2.3-12.2.10	E-Business Suite
Oracle Endeca Information Discovery Integrator, version 3.2.0.0	Fusion Middleware
Oracle Enterprise Communications Broker, versions 3.1, 3.2	Oracle Enterprise Communications Broker
Oracle Enterprise Data Quality, versions 11.1.1.9.0, 12.2.1.3.0	Fusion Middleware
Oracle Enterprise Repository, version 11.1.1.7.0	Fusion Middleware
Oracle Financial Services Analytical Applications Infrastructure, versions 8.0.6-8.1.0	Oracle Financial Services Analytical Applications Infrastructure
Oracle Financial Services Asset Liability Management, versions 8.0.7, 8.1.0	Oracle Financial Services Asset Liability Management
Oracle Financial Services Data Integration Hub, versions 8.0.3, 8.0.6	Oracle Financial Services Data Integration Hub
Oracle Financial Services Funds Transfer Pricing, versions 8.0.6, 8.0.7, 8.1.0	Oracle Financial Services Funds Transfer Pricing
Oracle Financial Services Market Risk Measurement and Management, version 8.0.6	Oracle Financial Services Market Risk Measurement and Management
Oracle Financial Services Profitability Management, versions 8.0.6, 8.0.7, 8.1.0	Oracle Financial Services Profitability Management
Oracle Financial Services Revenue Management and Billing, versions 2.9.0.0, 2.9.0.1	Oracle Financial Services Revenue Management and Billing
Oracle FLEXCUBE Core Banking, versions 11.5.0-11.9.0	Oracle Financial Services Applications
Oracle FLEXCUBE Universal Banking, version 14.4.0	Oracle Financial Services Applications
Oracle Fusion Middleware MapViewer, version 12.2.1.3.0	Fusion Middleware
Oracle Global Lifecycle Management OPatch	Fusion Middleware
Oracle Global Lifecycle Manager	Global Lifecycle Management
Oracle GoldenGate Application Adapters, version 19.1.0.0.0	Fusion Middleware
Oracle GraalVM Enterprise Edition, versions 19.3.4, 20.3.0	Oracle GraalVM Enterprise Edition
Oracle Health Sciences Information Manager, version 3.0.1	Health Sciences
Oracle Healthcare Master Person Index, version 4.0.2.5	Health Sciences
Oracle Hospitality Reporting and Analytics, version 9.1.0	Oracle Hospitality Reporting and Analytics
Oracle Hospitality Simphony, versions 18.2.7.2, 19.1.3	Oracle Hospitality Simphony
Oracle Insurance Allocation Manager for Enterprise Profitability, version 8.1.0	Oracle Insurance Allocation Manager for Enterprise Profitability
Oracle Insurance Insbridge Rating and Underwriting, versions 5.0.0.20, 5.1.1.3	Oracle Insurance Applications
Oracle Insurance Policy Administration, versions 10.2.0, 10.2.4, 11.0.2, 11.1.0-11.3.0	Oracle Insurance Applications
Oracle Insurance Rules Palette, versions 10.2.0, 10.2.4, 11.0.2, 11.1.0-11.3.0	Oracle Insurance Applications
Oracle Java SE, versions 7u281, 8u271	Java SE
Oracle Java SE Embedded, version 8u271	Java SE
Oracle Managed File Transfer, versions 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Oracle Outside In Technology, versions 8.5.4, 8.5.5	Fusion Middleware
Oracle Real-Time Decision Server, version 3.2.1.0	Fusion Middleware
Oracle Retail Assortment Planning, version 16.0.3	Retail Applications
Oracle Retail Bulk Data Integration, versions 15.0.3, 16.0.3	Retail Applications
Oracle Retail Customer Management and Segmentation Foundation, versions 16.0, 17.0, 18.0, 19.0	Retail Applications
Oracle Retail Extract Transform and Load, versions 13.2.5, 13.2.8	Retail Applications
Oracle Retail Financial Integration, versions 14.1.3, 15.0.3, 16.0.3	Retail Applications
Oracle Retail Integration Bus, versions 14.1.3, 15.0.3, 16.0.3	Retail Applications
Oracle Retail Invoice Matching, versions 13.2, 14.0, 14.1	Retail Applications
Oracle Retail Merchandising System, version 15.0	Retail Applications
Oracle Retail Order Broker, versions 15.0, 16.0	Retail Applications
Oracle Retail Order Broker Cloud Service, version 15.0	Retail Applications
Oracle Retail Sales Audit, version 14.1	Retail Applications
Oracle Retail Service Backbone, versions 14.1.3, 15.0.3, 16.0.3	Retail Applications
Oracle Retail Store Inventory Management, versions 14.0.4.0, 14.1.3.0, 14.1.3.9, 15.0.3.0, 16.0.3.0	Retail Applications
Oracle SD-WAN Edge, version 9.0	Oracle SD-WAN Edge
Oracle Secure Backup	Oracle Secure Backup
Oracle Transportation Management, version 1.4.3	Oracle Supply Chain Products
Oracle Utilities Framework, versions 4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0-4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0	Oracle Utilities Applications
Oracle VM VirtualBox, versions prior to 6.1.18	Virtualization
Oracle WebCenter Portal, versions 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Oracle WebCenter Sites, versions 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Oracle WebLogic Server, versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0	Fusion Middleware
Oracle ZFS Storage Appliance Kit, version 8.8	Systems
PeopleSoft Enterprise FIN Payables, version 9.2	PeopleSoft
PeopleSoft Enterprise HCM Human Resources, version 9.2	PeopleSoft
PeopleSoft Enterprise PeopleTools, versions 8.56, 8.57, 8.58	PeopleSoft
Primavera Gateway, versions 16.2.0-16.2.11, 17.12.0-17.12.9, 18.8.0-18.8.10, 19.12.0-19.12.10	Oracle Construction and Engineering Suite
Primavera P6 Enterprise Project Portfolio Management, versions 16.1.0-16.2.20, 17.1.0-17.12.19, 18.1.0-18.8.21, 19.12.0-19.12.10	Oracle Construction and Engineering Suite
Primavera Unifier, versions 16.1, 16.2, 17.7-17.12, 18.8, 19.12, 20.12	Oracle Construction and Engineering Suite
Siebel Applications, versions 20.12 and prior	Siebel
StorageTek Tape Analytics SW Tool, version 2.3.1	Systems

Note:

Vulnerabilities affecting either Oracle Database or Oracle Fusion Middleware may affect Oracle Fusion Applications, so Oracle customers should refer to Oracle Fusion Applications Critical Patch Update Knowledge Document, My Oracle Support Note 1967316.1 for information on patches to be applied to Fusion Application environments.
Vulnerabilities affecting Oracle Solaris may affect Oracle ZFSSA so Oracle customers should refer to the Oracle and Sun Systems Product Suite Critical Patch Update Knowledge Document, My Oracle Support Note 2160904.1 for information on minimum revisions of security patches required to resolve ZFSSA issues published in Critical Patch Updates and Solaris Third Party bulletins.
Solaris Third Party Bulletins are used to announce security patches for third party software distributed with Oracle Solaris. Solaris 10 customers should refer to the latest patch-sets which contain critical security fixes and detailed in Systems Patch Availability Document. Please see Reference Index of CVE IDs and Solaris Patches (My Oracle Support Note 1448883.1) for more information.
Users running Java SE with a browser can download the latest release from https://java.com. Users on the Windows and Mac OS X platforms can also use automatic updates to get the latest release.

Risk Matrix Content

Security vulnerabilities are scored using CVSS version 3.1 (see Oracle CVSS Scoring for an explanation of how Oracle applies CVSS version 3.1).

Oracle lists updates that address vulnerabilities in third-party components which are not exploitable in the context of their inclusion in their respective Oracle product beneath the product’s risk matrix.

Workarounds

Skipped Critical Patch Updates

Critical Patch Update Supported Products and Versions

Credit Statement

The following people or organizations reported security vulnerabilities addressed by this Critical Patch Update to Oracle:

0rich1 of Ant Security FG Lab: CVE-2021-2109
0xfoxone: CVE-2021-2068
Alessandro Bosco of TIM S.p.A: CVE-2021-2005
Alves Christopher of Telecom Nancy: CVE-2021-2006, CVE-2021-2010, CVE-2021-2011
Amey Anekar of CyberCube Services: CVE-2021-2052
Amy Tran: CVE-2021-2026, CVE-2021-2027
Andrej Simko of Accenture: CVE-2021-2077, CVE-2021-2078, CVE-2021-2079, CVE-2021-2080, CVE-2021-2082, CVE-2021-2083, CVE-2021-2084, CVE-2021-2085, CVE-2021-2090, CVE-2021-2091, CVE-2021-2092, CVE-2021-2093, CVE-2021-2094, CVE-2021-2096, CVE-2021-2097, CVE-2021-2098, CVE-2021-2099, CVE-2021-2100, CVE-2021-2101, CVE-2021-2102, CVE-2021-2103, CVE-2021-2104, CVE-2021-2105, CVE-2021-2106, CVE-2021-2107, CVE-2021-2114, CVE-2021-2115, CVE-2021-2118
Antonin B. of NCIA / NCSC: CVE-2021-2017
Bui Duong from Viettel Cyber Security: CVE-2021-2013, CVE-2021-2049, CVE-2021-2050, CVE-2021-2051
ChauUHM from Sacombank: CVE-2021-2062
ChenNan Of Chaitin Security Research Lab: CVE-2021-2086, CVE-2021-2111, CVE-2021-2112, CVE-2021-2119, CVE-2021-2120, CVE-2021-2121, CVE-2021-2125, CVE-2021-2126, CVE-2021-2129, CVE-2021-2131
Chi Tran: CVE-2021-2026, CVE-2021-2027
Chris Barnabo: CVE-2021-2128
Cl0und Syclover Security Team: CVE-2020-14756
Codeplutos of AntGroup FG Security Lab: CVE-2020-14756, CVE-2021-2075
DoHyun Lee of VirtualBoBs: CVE-2021-2086
Eddie Zhu of Beijing DBSEC Technology Co., Ltd: CVE-2021-2035, CVE-2021-2054
Edoardo Predieri of TIM S.p.A: CVE-2021-2005
Emad Al-Mousa working with Trend Micro Zero Day Initiative: CVE-2021-2054
Esteban Montes Morales of Accenture: CVE-2021-2089
Fabio Minarelli of TIM S.p.A: CVE-2021-2005
Francesco Russo of TIM S.p.A: CVE-2021-2005
Gaoning Pan of Zhejiang University & Ant Security Light-Year Lab: CVE-2021-2073, CVE-2021-2074, CVE-2021-2086, CVE-2021-2123, CVE-2021-2130
Girlelecta: CVE-2021-2066, CVE-2021-2067, CVE-2021-2069
Glassy of Alibaba Cloud Security Group: CVE-2021-2109
Hangfan Zhang: CVE-2021-2030
Julien Zhan of Telecom Nancy: CVE-2021-2006, CVE-2021-2010, CVE-2021-2011
JungHyun Kim (jidoc01) of VirtualBoBs: CVE-2021-2124
JunYoung Park and DongJun Shin of VirtualBoBs: CVE-2021-2127
Khuyen Nguyen of secgit.com: CVE-2021-2023
Kun Yang of Chaitin Security Research Lab: CVE-2021-2086, CVE-2021-2111, CVE-2021-2112, CVE-2021-2119, CVE-2021-2120, CVE-2021-2121, CVE-2021-2125, CVE-2021-2126, CVE-2021-2129, CVE-2021-2131
Longofo of Knownsec 404 Team: CVE-2021-2109
Luca Di Giuseppe of TIM S.p.A: CVE-2021-2005
Lukasz Plonka: CVE-2021-2063
Lukasz Rupala of ING Tech Poland: CVE-2021-2003
Maciej Grabiec of ING Tech Poland: CVE-2021-2063
Massimiliano Brolli of TIM S.p.A: CVE-2021-2005
Nam HaBach of NightSt0rm: CVE-2021-2034
Omur Ugur of Turk Telekom: CVE-2021-2003
Pawel Gocyla of ING Tech Poland: CVE-2021-2063
Philippe Antoine of Telecom Nancy: CVE-2021-2006, CVE-2021-2010, CVE-2021-2011
r00t4dm at Cloud-Penetrating Arrow Lab: CVE-2021-2109
Roberto Suggi Liverani of NCIA / NCSC: CVE-2021-2017
Rui Zhong: CVE-2021-2030
Rémi Badonnel of Telecom Nancy: CVE-2021-2010, CVE-2021-2011
Shimizu Kawasaki of DiDiGlobal Security Product Technology Department (Basic Security): CVE-2021-2109
Thiscodecc: CVE-2021-2047
Trung Le: CVE-2021-2026, CVE-2021-2027
Tuan Anh Nguyen of Viettel Cyber Security: CVE-2021-2025, CVE-2021-2029
Ved Prabhu: CVE-2021-2116, CVE-2021-2117
Xiayu Zhang of Tencent Keen Security Lab: CVE-2021-2064
Xingwei Lin of Ant Security Light-Year Lab: CVE-2021-2073, CVE-2021-2074, CVE-2021-2086, CVE-2021-2123, CVE-2021-2130
Xu Yuanzhen of Alibaba Cloud Security Team: CVE-2021-2109
Yakov Shafranovich of T. Rowe Price Associates, Inc.: CVE-2021-2018
Yaoguang Chen of Ant Security Light-Year Lab: CVE-2021-2055
Yongheng Chen: CVE-2021-2030
Yu Wang of BMH Security Team: CVE-2021-2108
Zhangyanyu of Chaitin Security Research Lab: CVE-2021-2131
Zouhair Janatil-Idrissi of Telecom Nancy: CVE-2021-2006, CVE-2021-2010, CVE-2021-2011

Security-In-Depth Contributors

In this Critical Patch Update, Oracle recognizes the following for contributions to Oracle’s Security-In-Depth program.:

Markus Loewe [2 reports]
Salini Reus of Fiji Roads Authority

On-Line Presence Security Contributors

For this quarter, Oracle recognizes the following for contributions to Oracle’s On-Line Presence Security program:

Aakash Adhikari (dark_haxor)
Adam Willard [2 reports]
Ahlan S
Ahmed Alwardani
Ahmed Ouahabi
Anas Rahmani
Ayushmaan Banerjee
Boo
Bradley Baker
Bui Dinh Bao aka 0xd0ff9 of Zalo Security Team (VNG Corp)
Bui Duc Anh Khoa aka khoabda of Zalo Security Team (VNG Corp)
Christopher Hanlon
Fabien B
Flaviu Popescu
Hamoud Al-Helmani [2 reports]
Harpreet Singh
Harshal S. Sharma
Mahmoud ElSayed
Marwan Albahar [6 reports]
Matt Bushey
Mohammad Hosein Askari
Phan Quan of VNPT Information Security Center (VNPT ISC)
Prabharoop C.C. [2 reports]
Prashant Saini
Pratik Khalane
Purbasha Ghosh
Quan Doan of R&D Center – VinCSS LLC (a member of Vingroup) [5 reports]
Ram Kumar
Ratnadip Gajbhiye
Robert Kulig
Robert Lee Dick
Sarwar Abbas
Saurabh Dilip Mhatre
Shailesh Kumavat
Shivam Pandey
Tuan Anh Nguyen of Viettel Cyber Security
Virendra Singh Rathore

Critical Patch Update Schedule

Critical Patch Updates are released on the Tuesday closest to the 17th day of January, April, July and October. The next four dates are:

20 April 2021
20 July 2021
19 October 2021
18 January 2022

References

Modification History

Date	Note
2021-February-22	Rev 3. Updated the affected versions for CVE-2021-2047
2021-January-25	Rev 2. Update to Credit Statements.
2021-January-19	Rev 1. Initial Release.

Oracle Database Server Risk Matrix

This Critical Patch Update contains 8 new security patches plus additional third party patches noted below for Oracle Database Products. 1 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. None of these patches are applicable to client-only installations, i.e., installations that do not have the Oracle Database Server installed. The English text form of this Risk Matrix can be found here.

CVE#	Component	Package and/or Privilege Required	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Component	Package and/or Privilege Required	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2021-2035	RDBMS Scheduler	Export Full Database	Oracle Net	No	8.8	Network	Low	Low	None	Un- changed	High	High	High	12.1.0.2, 12.2.0.1, 18c, 19c
CVE-2021-2018	Advanced Networking Option	None	Oracle Net	Yes	8.3	Network	High	None	Required	Changed	High	High	High	18c, 19c	See Note 1
CVE-2021-2054	RDBMS Sharding	Create Any Procedure, Create Any View, Create Any Trigger	Oracle Net	No	7.2	Network	Low	High	None	Un- changed	High	High	High	12.2.0.1, 18c, 19c
CVE-2021-2116	Oracle Application Express Opportunity Tracker	Valid User Account	HTTP	No	5.4	Network	Low	Low	Required	Changed	Low	Low	None	Prior to 20.2
CVE-2021-2117	Oracle Application Express Survey Builder	Valid User Account	HTTP	No	5.4	Network	Low	Low	Required	Changed	Low	Low	None	Prior to 20.2
CVE-2021-1993	Java VM	Create Session	Oracle Net	No	4.8	Network	High	Low	Required	Un- changed	None	High	None	12.1.0.2, 12.2.0.1, 18c, 19c
CVE-2021-2045	Oracle Text	Create Session	Oracle Net	No	3.1	Network	High	Low	None	Un- changed	None	None	Low	12.1.0.2, 12.2.0.1, 18c, 19c
CVE-2021-2000	Unified Audit	SYS Account	Oracle Net	No	2.4	Network	Low	High	Required	Un- changed	None	Low	None	12.1.0.2, 12.2.0.1, 18c, 19c

Notes:

CVE-2021-2018 affects Windows platform only.

Additional patches are included in this Critical Patch Update for the following non-exploitable CVEs in this Oracle product family:

Perl: CVE-2020-10878, CVE-2020-10543 and CVE-2020-12723.

Oracle Global Lifecycle Management Risk Matrix

This Critical Patch Update contains no new security patches but does include third party patches noted below for Oracle Global Lifecycle Management. Please refer to previous Critical Patch Update Advisories if the last Critical Patch Update was not applied for Oracle Global Lifecycle Management. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
There are no exploitable vulnerabilities for these products. Third party patches for non-exploitable CVEs are noted below.

Additional patches are included in this Critical Patch Update for the following non-exploitable CVEs in this Oracle product family:

Oracle Global Lifecycle Manager
- Patch Installer (Apache Commons Compress): CVE-2019-12402.

Oracle Secure Backup Risk Matrix

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
There are no exploitable vulnerabilities for these products. Third party patches for non-exploitable CVEs are noted below.

Additional patches are included in this Critical Patch Update for the following non-exploitable CVEs in this Oracle product family:

Oracle Secure Backup
- User Interface (PHP): CVE-2020-7064.
- Web Server (Apache HTTP Server): CVE-2020-11984, CVE-2020-11993 and CVE-2020-9490.

Oracle Communications Applications Risk Matrix

This Critical Patch Update contains 8 new security patches for Oracle Communications Applications. 6 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-14195	Oracle Communications Calendar Server	REST API (jackson-databind)	HTTP	Yes	8.1	Network	High	None	None	Un- changed	High	High	High	8.0.0.4.0
CVE-2020-14195	Oracle Communications Contacts Server	REST API (jackson-databind)	HTTP	Yes	8.1	Network	High	None	None	Un- changed	High	High	High	8.0.0.5.0
CVE-2019-17566	Oracle Communications MetaSolv Solution	Print Preview (Apache Batik)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	6.3.0-6.3.1
CVE-2020-13871	Oracle Communications Network Charging and Control	Common (SQLite)	SQL	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	6.0.1, 12.0.2
CVE-2019-10086	Oracle Communications BRM – Elastic Charging Engine	Coherence Query (Apache Commons BeanUtils)	TCP/IP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	11.3.0.9, 12.0.0.3
CVE-2019-10086	Oracle Communications MetaSolv Solution	Online Help (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	6.3.0-6.3.1
CVE-2020-5421	Oracle Communications BRM – Elastic Charging Engine	Orchestration, Processor and Messages (Spring Framework)	TCP/IP	No	6.5	Network	High	Low	Required	Changed	Low	High	None	11.3.0.9, 12.0.0.3
CVE-2020-1945	Oracle Communications ASAP	Core (Apache Ant)	None	No	6.2	Local	Low	None	None	Un- changed	High	None	None	7.3

Additional CVEs addressed are:

The patch for CVE-2020-13871 also addresses CVE-2020-15358.
The patch for CVE-2020-14195 also addresses CVE-2020-14060, CVE-2020-14061 and CVE-2020-14062.
The patch for CVE-2020-1945 also addresses CVE-2017-5645.

Oracle Communications Risk Matrix

This Critical Patch Update contains 12 new security patches for Oracle Communications. 7 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2019-7164	Oracle Communications Operations Monitor	ORMB DB Query in VSP (SQLAlchemy)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	4.2, 4.3
CVE-2020-24750	Oracle Communications Diameter Signaling Router (DSR)	IDIH (jackson-databind)	HTTP	Yes	8.1	Network	High	None	None	Un- changed	High	High	High	8.0.0-8.2.2
CVE-2020-27216	Oracle Communications Application Session Controller	Core (Eclipse Jetty)	None	No	7.8	Local	Low	Low	None	Un- changed	High	High	High	3.9m0p2
CVE-2020-27216	Oracle Communications Element Manager	REST API (Eclipse Jetty)	None	No	7.8	Local	Low	Low	None	Un- changed	High	High	High	8.2.1.0-8.2.2.1
CVE-2020-14147	Oracle Communications Operations Monitor	In-Memeory DB for FDP/VSP (Redis)	HTTP	No	7.7	Network	Low	Low	None	Changed	None	None	High	3.4, 4.1, 4.2, 4.3
CVE-2019-17566	Oracle Communications Application Session Controller	Core (Apache Batik)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	3.9m0p2
CVE-2020-11080	Oracle Enterprise Communications Broker	System (nghttp2)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	3.1, 3.2
CVE-2019-10086	Oracle Communications Diameter Signaling Router (DSR)	IDIH (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	8.0.0-8.2.2
CVE-2019-10086	Oracle SD-WAN Edge	Management (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	9.0
CVE-2020-10723	Oracle Enterprise Communications Broker	System (DPDK)	None	No	6.7	Local	Low	High	None	Un- changed	High	High	High	3.1, 3.2
CVE-2020-5421	Oracle Communications Session Report Manager	Core (Spring Framework)	HTTP	No	6.5	Network	High	Low	Required	Changed	Low	High	None	8.2.1.0-8.2.2.1
CVE-2019-1559	Oracle Communications Performance Intelligence Center (PIC) Software	Security (OpenSSL)	HTTPS	Yes	5.9	Network	High	None	None	Un- changed	High	None	None	10.4.0.2

Additional CVEs addressed are:

The patch for CVE-2019-1559 also addresses CVE-2018-0732.
The patch for CVE-2019-7164 also addresses CVE-2019-7548.
The patch for CVE-2020-10723 also addresses CVE-2020-10722, CVE-2020-10724, CVE-2020-10725 and CVE-2020-10726.
The patch for CVE-2020-11080 also addresses CVE-2019-9511 and CVE-2019-9513.
The patch for CVE-2020-24750 also addresses CVE-2020-24616 and CVE-2020-9546.

Oracle Construction and Engineering Risk Matrix

This Critical Patch Update contains 7 new security patches for Oracle Construction and Engineering. 5 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-25020	Primavera Unifier	Platform (MPXJ)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	16.1, 16.2, 17.7-17.12, 18.8, 19.12, 20.12
CVE-2019-17566	Instantis EnterpriseTrack	Dashboard module (Apache Batik)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	17.1-17.3
CVE-2020-11979	Primavera Gateway	Admin (Apache Ant)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	16.2.0-16.2.11, 17.12.0-17.12.9
CVE-2020-11979	Primavera Unifier	Core, Config (Apache Ant)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	16.1, 16.2, 17.7-17.12, 18.8, 19.12, 20.12
CVE-2019-10086	Primavera Unifier	Core (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	16.1, 16.2, 17.7-17.12, 18.8, 19.12, 20.12
CVE-2020-5421	Primavera Gateway	Admin (Spring Framework)	HTTP	No	6.5	Network	High	Low	Required	Changed	Low	High	None	16.2.0-16.2.11, 17.12.0-17.12.9, 18.8.0-18.8.10, 19.12.0-19.12.10
CVE-2020-5421	Primavera P6 Enterprise Project Portfolio Management	Web access (Spring Framework)	HTTP	No	6.5	Network	High	Low	Required	Changed	Low	High	None	16.1.0-16.2.20, 17.1.0-17.12.19, 18.1.0-18.8.21, 19.12.0-19.12.10

Additional CVEs addressed are:

The patch for CVE-2020-25020 also addresses CVE-2020-35460.

Oracle E-Business Suite Risk Matrix

This Critical Patch Update contains 31 new security patches for Oracle E-Business Suite. 29 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

Oracle E-Business Suite products include Oracle Database and Oracle Fusion Middleware components that are affected by the vulnerabilities listed in the Oracle Database and Oracle Fusion Middleware sections. The exposure of Oracle E-Business Suite products is dependent on the Oracle Database and Oracle Fusion Middleware versions being used. Oracle Database and Oracle Fusion Middleware security updates are not listed in the Oracle E-Business Suite risk matrix. However, since vulnerabilities affecting Oracle Database and Oracle Fusion Middleware versions may affect Oracle E-Business Suite products, Oracle recommends that customers apply the January 2021 Critical Patch Update to the Oracle Database and Oracle Fusion Middleware components of Oracle E-Business Suite. For information on what patches need to be applied to your environments, refer to Oracle E-Business Suite Release 12 Critical Patch Update Knowledge Document (January 2021), My Oracle Support Note 2737201.1.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2021-2029	Oracle Scripting	Miscellaneous	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.1.1-12.1.3, 12.2.3-12.2.8
CVE-2021-2100	Oracle One-to-One Fulfillment	Print Server	HTTP	Yes	9.1	Network	Low	None	None	Un- changed	High	High	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2101	Oracle One-to-One Fulfillment	Print Server	HTTP	Yes	9.1	Network	Low	None	None	Un- changed	High	High	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2093	Oracle Common Applications	CRM User Management Framework	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2114	Oracle Common Applications Calendar	Applications Calendar	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2034	Oracle Common Applications Calendar	Tasks	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1-12.1.3
CVE-2021-2084	Oracle CRM Technical Foundation	Preferences	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.3, 12.2.3-12.2.10
CVE-2021-2085	Oracle CRM Technical Foundation	Preferences	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.3, 12.2.3-12.2.10
CVE-2021-2092	Oracle CRM Technical Foundation	Preferences	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.3, 12.2.3-12.2.10
CVE-2021-2099	Oracle CRM Technical Foundation	Preferences	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.2.3-12.2.10
CVE-2021-2105	Oracle Customer Interaction History	Outcome-Result	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2106	Oracle Customer Interaction History	Outcome-Result	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2107	Oracle Customer Interaction History	Outcome-Result	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2090	Oracle Email Center	Message Display	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2098	Oracle Email Center	Message Display	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2089	Oracle iStore	Runtime Catalog	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2077	Oracle iStore	Shopping Cart	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2082	Oracle iStore	Shopping Cart	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2096	Oracle iStore	Shopping Cart	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2097	Oracle iSupport	Profile	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2083	Oracle iSupport	User Responsibilities	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2026	Oracle Marketing	Marketing Administration	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2027	Oracle Marketing	Marketing Administration	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2118	Oracle Marketing	Marketing Administration	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2094	Oracle One-to-One Fulfillment	Print Server	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2091	Oracle Scripting	Miscellaneous	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2015	Oracle Workflow	Worklist	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.2.3-12.2.10
CVE-2021-2115	Oracle Common Applications Calendar	Tasks	HTTP	No	7.6	Network	Low	Low	Required	Changed	High	Low	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2059	Oracle iStore	Web interface	HTTP	Yes	5.3	Network	Low	None	None	Un- changed	Low	None	None	12.1.1-12.1.3, 12.2.3-12.2.10
CVE-2021-2023	Oracle Installed Base	APIs	HTTP	Yes	4.7	Network	Low	None	Required	Changed	None	Low	None	12.1.1-12.1.3, 12.2.3-12.2.9
CVE-2021-2017	Oracle User Management	Proxy User Delegation	HTTP	No	4.3	Network	Low	Low	None	Un- changed	Low	None	None	12.1.3, 12.2.3-12.2.10

Oracle Enterprise Manager Risk Matrix

Oracle Enterprise Manager products include Oracle Database and Oracle Fusion Middleware components that are affected by the vulnerabilities listed in the Oracle Database and Oracle Fusion Middleware sections. The exposure of Oracle Enterprise Manager products is dependent on the Oracle Database and Oracle Fusion Middleware versions being used. Oracle Database and Oracle Fusion Middleware security updates are not listed in the Oracle Enterprise Manager risk matrix. However, since vulnerabilities affecting Oracle Database and Oracle Fusion Middleware versions may affect Oracle Enterprise Manager products, Oracle recommends that customers apply the January 2021 Critical Patch Update to the Oracle Database and Oracle Fusion Middleware components of Enterprise Manager. For information on what patches need to be applied to your environments, refer to Critical Patch Update January 2021 Patch Availability Document for Oracle Products, My Oracle Support Note 2725756.1.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2019-13990	Enterprise Manager Base Platform	Connector Framework (Quartz)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	13.2.1.0
CVE-2020-11973	Enterprise Manager Base Platform	Reporting Framework (Apache Camel)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	13.3.0.0, 13.4.0.0
CVE-2016-1000031	Enterprise Manager Base Platform	Reporting Framework (Apache Commons FileUpload)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	13.3.0.0, 13.4.0.0
CVE-2020-11984	Enterprise Manager Ops Center	Control Proxy (Apache HTTP Server)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.4.0.0
CVE-2020-10683	Oracle Application Testing Suite	Load Testing for Web Apps (dom4j)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	13.3.0.1
CVE-2018-15756	Enterprise Manager for Fusion Applications	Topology Viewer (Spring Framework)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	13.3.0.0
CVE-2020-11022	Oracle Application Testing Suite	Load Testing for Web Apps (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	13.3.0.1
CVE-2015-4000	Enterprise Manager Ops Center	User Interface (OpenSSL)	HTTPS	Yes	3.7	Network	High	None	None	Un- changed	None	Low	None	12.4.0.0

Additional CVEs addressed are:

The patch for CVE-2016-1000031 also addresses CVE-2018-11775 and CVE-2019-0188.
The patch for CVE-2018-15756 also addresses CVE-2018-1258.
The patch for CVE-2019-13990 also addresses CVE-2019-5427.
The patch for CVE-2020-11022 also addresses CVE-2020-11023.
The patch for CVE-2020-11973 also addresses CVE-2019-0188, CVE-2020-11971 and CVE-2020-11972.
The patch for CVE-2020-11984 also addresses CVE-2020-11993 and CVE-2020-9490.

Oracle Financial Services Applications Risk Matrix

This Critical Patch Update contains 50 new security patches for Oracle Financial Services Applications. 41 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-11612	Oracle Banking Corporate Lending Process Management	Core (Netty)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	14.1.0, 14.3.0, 14.4.0
CVE-2020-11612	Oracle Banking Credit Facilities Process Management	Core (Netty)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	14.1.0, 14.3.0, 14.4.0
CVE-2019-10744	Oracle Banking Extensibility Workbench	Core (Lodash)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	14.3.0, 14.4.0
CVE-2020-8174	Oracle Banking Extensibility Workbench	Core (Node.js)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	14.3.0, 14.4.0
CVE-2020-11612	Oracle Banking Liquidity Management	Common (Netty)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	14.0.0-14.4.0
CVE-2020-11612	Oracle Banking Payments	Payments Core (Netty)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	14.4.0
CVE-2020-11612	Oracle Banking Supply Chain Finance	Core (Netty)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	14.2.0-14.4.0
CVE-2020-11612	Oracle Banking Trade Finance Process Management	Dashboard (Netty)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	14.1.0, 14.3.0, 14.4.0
CVE-2020-11612	Oracle Banking Virtual Account Management	Common Core (Netty)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	14.1.0, 14.3.0, 14.4.0
CVE-2019-3773	Oracle Financial Services Analytical Applications Infrastructure	Infrastructure (Spring Web Services)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	8.0.6-8.1.0
CVE-2019-0230	Oracle Financial Services Data Integration Hub	User Interface (Apache Struts)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	8.0.3, 8.0.6
CVE-2019-0230	Oracle Financial Services Market Risk Measurement and Management	User Interface (Apache Struts)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	8.0.6
CVE-2020-11612	Oracle FLEXCUBE Universal Banking	Infrastructure (Netty)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	14.4.0
CVE-2020-1945	Oracle Banking Liquidity Management	Common (Apache Ant)	HTTP	Yes	9.1	Network	Low	None	None	Un- changed	High	High	None	14.0.0-14.4.0
CVE-2020-27216	Oracle FLEXCUBE Core Banking	Securities (Eclipse Jetty)	None	No	7.8	Local	Low	Low	None	Un- changed	High	High	High	11.5.0-11.9.0
CVE-2019-12399	Oracle Banking Corporate Lending Process Management	Core (Apache Kafka)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	High	None	None	14.1.0, 14.3.0, 14.4.0
CVE-2019-12399	Oracle Banking Credit Facilities Process Management	Core (Apache Kafka)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	High	None	None	14.1.0, 14.3.0, 14.4.0
CVE-2019-12399	Oracle Banking Liquidity Management	Common (Apache Kafka)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	High	None	None	14.0.0-14.4.0
CVE-2019-12399	Oracle Banking Payments	Payments Core (Apache Kafka)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	High	None	None	14.4.0
CVE-2020-11979	Oracle Banking Platform	Installer (Apache Ant)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	2.4.0, 2.4.1, 2.6.2, 2.7.0, 2.7.1, 2.8.0
CVE-2019-12402	Oracle Banking Platform	Party, Financials (Apache Commons Compress)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	2.6.2, 2.7.0, 2.8.0, 2.9.0
CVE-2019-12399	Oracle Banking Platform	Product Manufacturing (Apache Kafka)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	High	None	None	2.7.0
CVE-2019-12399	Oracle Banking Supply Chain Finance	Core (Apache Kafka)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	High	None	None	14.2.0-14.4.0
CVE-2019-12399	Oracle Banking Trade Finance Process Management	Dashboard (Apache Kafka)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	High	None	None	14.1.0, 14.3.0, 14.4.0
CVE-2019-12399	Oracle Banking Virtual Account Management	Common Core (Apache Kafka)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	High	None	None	14.1.0, 14.3.0, 14.4.0
CVE-2020-11979	Oracle Financial Services Analytical Applications Infrastructure	Infrastructure (Apache Ant)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	8.0.6-8.1.0
CVE-2019-12399	Oracle Financial Services Analytical Applications Infrastructure	Infrastructure (Apache Kafka)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	High	None	None	8.0.6-8.1.0
CVE-2019-12399	Oracle FLEXCUBE Universal Banking	Infrastructure (Apache Kafka)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	High	None	None	14.4.0
CVE-2019-10086	Oracle Financial Services Analytical Applications Infrastructure	Infrastructure (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	8.0.6-8.1.0
CVE-2019-10086	Oracle Financial Services Asset Liability Management	Core (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	8.0.7, 8.1.0
CVE-2019-10086	Oracle Financial Services Funds Transfer Pricing	Core (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	8.0.6, 8.0.7, 8.1.0
CVE-2019-10086	Oracle Financial Services Market Risk Measurement and Management	Core (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	8.0.6
CVE-2019-10086	Oracle Financial Services Profitability Management	Core (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	8.0.6, 8.0.7, 8.1.0
CVE-2019-10086	Oracle Insurance Allocation Manager for Enterprise Profitability	Core (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	8.1.0
CVE-2020-5408	Oracle Banking Corporate Lending Process Management	Core (Spring Security)	HTTP	No	6.5	Network	Low	Low	None	Un- changed	High	None	None	14.1.0, 14.3.0, 14.4.0
CVE-2020-5408	Oracle Banking Credit Facilities Process Management	Core (Spring Security)	HTTP	No	6.5	Network	Low	Low	None	Un- changed	High	None	None	14.1.0, 14.3.0, 14.4.0
CVE-2020-5408	Oracle Banking Liquidity Management	Common (Spring Security)	HTTP	No	6.5	Network	Low	Low	None	Un- changed	High	None	None	14.0.0-14.4.0
CVE-2020-5408	Oracle Banking Supply Chain Finance	Core (Spring Security)	HTTP	No	6.5	Network	Low	Low	None	Un- changed	High	None	None	14.2.0-14.4.0
CVE-2020-5408	Oracle Banking Trade Finance Process Management	Dashboard (Spring Security)	HTTP	No	6.5	Network	Low	Low	None	Un- changed	High	None	None	14.1.0, 14.3.0, 14.4.0
CVE-2020-5408	Oracle Banking Virtual Account Management	Common Core (Spring Security)	HTTP	No	6.5	Network	Low	Low	None	Un- changed	High	None	None	14.1.0, 14.3.0, 14.4.0
CVE-2020-5421	Oracle Financial Services Analytical Applications Infrastructure	Infrastructure (Spring Framework)	HTTP	No	6.5	Network	High	Low	Required	Changed	Low	High	None	8.0.6-8.1.0
CVE-2019-11269	Oracle Banking Corporate Lending Process Management	Core (Spring Security Oauth)	HTTP	Yes	5.4	Network	Low	None	Required	Un- changed	Low	Low	None	14.1.0, 14.3.0, 14.4.0
CVE-2019-11269	Oracle Banking Credit Facilities Process Management	Core (Spring Security Oauth)	HTTP	Yes	5.4	Network	Low	None	Required	Un- changed	Low	Low	None	14.1.0, 14.3.0, 14.4.0
CVE-2019-11269	Oracle Banking Liquidity Management	Common (Spring Security Oauth)	HTTP	Yes	5.4	Network	Low	None	Required	Un- changed	Low	Low	None	14.0.0-14.4.0
CVE-2019-11269	Oracle Banking Payments	Payments Core (Spring Security Oauth)	HTTP	Yes	5.4	Network	Low	None	Required	Un- changed	Low	Low	None	14.4.0
CVE-2019-11269	Oracle Banking Supply Chain Finance	Core (Spring Security Oauth)	HTTP	Yes	5.4	Network	Low	None	Required	Un- changed	Low	Low	None	14.2.0-14.4.0
CVE-2019-11269	Oracle Banking Trade Finance Process Management	Dashboard (Spring Security Oauth)	HTTP	Yes	5.4	Network	Low	None	Required	Un- changed	Low	Low	None	14.1.0, 14.3.0, 14.4.0
CVE-2019-11269	Oracle Banking Virtual Account Management	Common Core (Spring Security Oauth)	HTTP	Yes	5.4	Network	Low	None	Required	Un- changed	Low	Low	None	14.1.0, 14.3.0, 14.4.0
CVE-2019-11269	Oracle FLEXCUBE Universal Banking	Infrastructure (Spring Security Oauth)	HTTP	Yes	5.4	Network	Low	None	Required	Un- changed	Low	Low	None	14.4.0
CVE-2021-2113	Oracle Financial Services Revenue Management and Billing	On Demand Billing	HTTP	No	4.3	Network	Low	Low	None	Un- changed	None	Low	None	2.9.0.0, 2.9.0.1

Additional CVEs addressed are:

The patch for CVE-2019-0230 also addresses CVE-2019-0233 and CVE-2020-17530.
The patch for CVE-2019-11269 also addresses CVE-2019-3778.
The patch for CVE-2020-1945 also addresses CVE-2020-11979.
The patch for CVE-2020-5408 also addresses CVE-2020-5407.
The patch for CVE-2020-8174 also addresses CVE-2020-10531, CVE-2020-11080 and CVE-2020-8172.

Oracle Food and Beverage Applications Risk Matrix

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2018-1285	Oracle Hospitality Simphony	Simphony Server (Apache log4net)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	18.2.7.2, 19.1.3
CVE-2021-1997	Oracle Hospitality Reporting and Analytics	Report	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	9.1.0

Oracle Fusion Middleware Risk Matrix

This Critical Patch Update contains 60 new security patches plus additional third party patches noted below for Oracle Fusion Middleware. 47 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

Please note that the Security Alert patches for Oracle WebLogic Server: CVE-2020-14750 are included in this Critical Patch Update. Customers are strongly advised to apply this Critical Patch Update.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2019-10173	Oracle BAM (Business Activity Monitoring)	General (Xstream)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	11.1.1.9.0, 12.2.1.3.0
CVE-2020-10683	Oracle Business Process Management Suite	Installer (dom4j)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.2.1.3.0, 12.2.1.4.0
CVE-2020-14756	Oracle Coherence	Core Components	IIOP, T3	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
CVE-2015-8965	Oracle Data Integrator	Install, config, upgrade (Rogue Wave JViews)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.2.1.3.0, 12.2.1.4.0
CVE-2020-10683	Oracle Data Integrator	Runtime Java agent for ODI (dom4j)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.2.1.3.0, 12.2.1.4.0
CVE-2016-1000031	Oracle Enterprise Data Quality	General (Apache Commons FileUpload)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	11.1.1.9.0
CVE-2020-10683	Oracle Enterprise Data Quality	General (dom4j)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	11.1.1.9.0, 12.2.1.3.0
CVE-2020-11998	Oracle Enterprise Repository	Security Subsystem (Apache ActiveMQ)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	11.1.1.7.0
CVE-2020-10683	Oracle WebCenter Portal	Portlet Services (dom4j)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	11.1.1.9.0
CVE-2019-17195	Oracle WebLogic Server	Core Components (Connect2id Nimbus JOSE+JWT)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.2.1.3.0, 12.2.1.4.0
CVE-2021-1994	Oracle WebLogic Server	Web Services	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	10.3.6.0.0, 12.1.3.0.0
CVE-2021-2047	Oracle WebLogic Server	Core Components	IIOP, T3	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0
CVE-2021-2064	Oracle WebLogic Server	Core Components	IIOP, T3	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.1.3.0.0
CVE-2021-2108	Oracle WebLogic Server	Core Components	IIOP, T3	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.1.3.0.0
CVE-2021-2075	Oracle WebLogic Server	Samples	IIOP, T3	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
CVE-2020-1945	Oracle Real-Time Decision Server	Decision Studio (Apache Ant)	HTTP	Yes	9.1	Network	Low	None	None	Un- changed	High	High	None	3.2.1.0
CVE-2020-5421	Oracle Endeca Information Discovery Integrator	Integrator ETL (Spring Framework)	HTTP	No	8.8	Network	Low	Low	None	Un- changed	High	High	High	3.2.0.0
CVE-2021-2066	Oracle Outside In Technology	Outside In Filters	HTTP	Yes	8.6	Network	Low	None	None	Un- changed	Low	High	Low	8.5.4, 8.5.5	See Note 1
CVE-2021-2067	Oracle Outside In Technology	Outside In Filters	HTTP	Yes	8.6	Network	Low	None	None	Un- changed	Low	High	Low	8.5.4, 8.5.5	See Note 1
CVE-2021-2068	Oracle Outside In Technology	Outside In Filters	HTTP	Yes	8.6	Network	Low	None	None	Un- changed	Low	High	Low	8.5.4, 8.5.5	See Note 1
CVE-2021-2069	Oracle Outside In Technology	Outside In Filters	HTTP	Yes	8.6	Network	Low	None	None	Un- changed	Low	High	Low	8.5.4, 8.5.5	See Note 1
CVE-2021-2025	Oracle Business Intelligence Enterprise Edition	Analytics Web General	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2021-2041	Oracle Business Intelligence Enterprise Edition	Installation	HTTP	Yes	8.1	Network	High	None	None	Un- changed	High	High	High	12.2.1.3.0, 12.2.1.4.0
CVE-2021-2049	Oracle BI Publisher	Administration	HTTP	No	7.6	Network	Low	Low	None	Un- changed	High	Low	Low	5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2021-2013	Oracle BI Publisher	BI Publisher Security	HTTP	No	7.6	Network	Low	Low	None	Un- changed	High	Low	Low	5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2021-2050	Oracle BI Publisher	E-Business Suite – XDO	HTTP	No	7.6	Network	Low	Low	None	Un- changed	High	Low	Low	5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2021-2051	Oracle BI Publisher	E-Business Suite – XDO	HTTP	No	7.6	Network	Low	Low	None	Un- changed	High	Low	Low	5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2021-2062	Oracle BI Publisher	Web Server	HTTP	No	7.6	Network	Low	Low	Required	Changed	High	Low	None	5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2019-17359	Oracle Data Integrator	Runtime Java agent for ODI (Bouncy Castle Java Library)	HTTPS	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	12.2.1.4.0
CVE-2017-12626	Oracle Enterprise Data Quality	General (Apache POI)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	11.1.1.9.0, 12.2.1.3.0
CVE-2020-11979	Oracle Enterprise Repository	Security Subsystem (Apache Ant)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	11.1.1.7.0
CVE-2019-17566	Oracle Enterprise Repository	Security Subsystem (Apache Batik)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	11.1.1.7.0
CVE-2020-11994	Oracle Enterprise Repository	Security Subsystem (Apache Camel)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	High	None	None	11.1.1.7.0
CVE-2020-13935	Oracle Managed File Transfer	MFT Runtime Server (Apache Tomcat)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	12.2.1.3.0, 12.2.1.4.0
CVE-2019-0227	Oracle Real-Time Decision Server	Platform Installation (Apache Axis)	HTTP	Yes	7.5	Adjacent Network	High	None	None	Un- changed	High	High	High	3.2.1.0
CVE-2019-10086	Oracle Data Integrator	Install, config, upgrade (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2019-10086	Oracle Endeca Information Discovery Integrator	Integrator ETL (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	3.2.0.0
CVE-2019-10086	Oracle Fusion Middleware MapViewer	Install (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	12.2.1.3.0
CVE-2019-10086	Oracle Real-Time Decision Server	Platform Installation (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	3.2.1.0
CVE-2019-10086	Oracle WebCenter Portal	Security Framework (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2019-10086	Oracle WebLogic Server	Console (Apache Commons Beanutils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2021-2109	Oracle WebLogic Server	Console	HTTP	No	7.2	Network	Low	High	None	Un- changed	High	High	High	10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
CVE-2018-2587	Oracle Adaptive Access Manager	Install and Config	HTTP	Yes	6.5	Network	High	None	None	Un- changed	Low	High	None	11.1.2.3.0
CVE-2018-9019	Oracle Data Integrator	Rest Service (Dolibarr)	HTTP	Yes	6.5	Network	Low	None	None	Un- changed	Low	Low	None	11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2020-5421	Oracle GoldenGate Application Adapters	Application Adapters (Spring Framework)	HTTP	No	6.5	Network	High	Low	Required	Changed	Low	High	None	19.1.0.0.0
CVE-2020-5421	Oracle WebLogic Server	Sample apps (Spring Framework)	HTTP	No	6.5	Network	High	Low	Required	Changed	Low	High	None	10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
CVE-2021-1995	Oracle WebLogic Server	Web Services	HTTP	No	6.5	Network	Low	Low	None	Un- changed	None	High	None	10.3.6.0.0, 12.1.3.0.0
CVE-2019-14862	Oracle Business Intelligence Enterprise Edition	Analytics Server (Knockout)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	5.5.0.0.0
CVE-2019-17091	Oracle Enterprise Data Quality	General (Eclipse Mojarra)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	12.2.1.3.0
CVE-2020-11022	Oracle WebCenter Sites	WebCenter Sites (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	12.2.1.3.0, 12.2.1.4.0
CVE-2020-11022	Oracle WebLogic Server	Sample apps (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
CVE-2016-5725	Oracle Data Integrator	Install, config, upgrade (JCraft JSch)	SFTP	Yes	5.9	Network	High	None	None	Un- changed	None	High	None	11.1.1.9.0, 12.2.1.3.0
CVE-2018-10237	Oracle WebLogic Server	Centralized Thirdparty Jars (Google Guava)	HTTP	Yes	5.9	Network	High	None	None	Un- changed	None	None	High	12.2.1.3.0
CVE-2021-2003	Business Intelligence Enterprise Edition	Analytics Web Dashboards	HTTP	No	5.4	Network	Low	Low	Required	Changed	Low	Low	None	5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2019-10247	Oracle Data Integrator	Centralized Thirdparty Jars (Eclipse Jetty)	HTTP	Yes	5.3	Network	Low	None	None	Un- changed	Low	None	None	12.2.1.3.0, 12.2.1.4.0
CVE-2021-2005	Oracle Business Intelligence Enterprise Edition	BI Platform Security	HTTP	Yes	4.7	Network	Low	None	Required	Changed	Low	None	None	12.2.1.3.0, 12.2.1.4.0
CVE-2021-2033	Oracle WebLogic Server	Core Components	HTTP	No	4.3	Network	Low	Low	None	Un- changed	None	None	Low	12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
CVE-2020-9488	Oracle Data Integrator	Install, config, upgrade (Apache Log4j)	HTTP	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	12.2.1.3.0, 12.2.1.4.0
CVE-2020-9488	Oracle GoldenGate Application Adapters	Application Adapters (Apache Log4j)	HTTP	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	19.1.0.0.0
CVE-2021-1996	Oracle WebLogic Server	Web Services	HTTP	No	2.4	Network	Low	High	Required	Un- changed	Low	None	None	10.3.6.0.0, 12.1.3.0.0

Notes:

Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower.

Additional CVEs addressed are:

The patch for CVE-2018-9019 also addresses CVE-2017-5611 and CVE-2018-7318.
The patch for CVE-2019-0227 also addresses CVE-2018-8032.
The patch for CVE-2019-10247 also addresses CVE-2019-10246.
The patch for CVE-2020-11022 also addresses CVE-2020-11023.
The patch for CVE-2020-13935 also addresses CVE-2020-13934.
The patch for CVE-2021-2041 also addresses CVE-2019-2697.

Additional patches are included in this Critical Patch Update for the following non-exploitable CVEs in this Oracle product family:

Oracle Global Lifecycle Management OPatch
- Patch Installer (Apache Commons Compress): CVE-2019-12402 and CVE-2012-2098.

Oracle GraalVM Risk Matrix

This Critical Patch Update contains 2 new security patches for Oracle GraalVM. Both of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-8277	Oracle GraalVM Enterprise Edition	Node (Node.js)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	19.3.4, 20.3.0
CVE-2020-14803	Oracle GraalVM Enterprise Edition	Java	Multiple	Yes	5.3	Network	High	None	Required	Un- changed	None	High	None	19.3.4, 20.3.0

Additional CVEs addressed are:

The patch for CVE-2020-8277 also addresses CVE-2020-1971, CVE-2020-8265 and CVE-2020-8287.

Oracle Health Sciences Applications Risk Matrix

This Critical Patch Update contains 5 new security patches for Oracle Health Sciences Applications. 3 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-10683	Oracle Health Sciences Information Manager	Recordlocator, DSUB (dom4j)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	3.0.1
CVE-2020-5421	Oracle Healthcare Master Person Index	MDM Module (Spring Framework)	HTTP	No	6.5	Network	High	Low	Required	Changed	Low	High	None	4.0.2.5
CVE-2021-2040	Oracle Argus Safety	Case Form, Local Affiliate Form	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.2.2
CVE-2021-2110	Oracle Argus Safety	Letters	HTTP	No	5.0	Network	Low	Low	None	Changed	Low	None	None	8.2.2
CVE-2020-9488	Oracle Health Sciences Information Manager	Recordlocator, DSUB (Apache Log4j)	HTTP	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	3.0.1

Oracle Hyperion Risk Matrix

This Critical Patch Update contains 7 new security patches for Oracle Hyperion. 5 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2019-13990	Hyperion Infrastructure Technology	Common Security (Quartz)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	11.1.2.4
CVE-2020-11984	Hyperion Infrastructure Technology	Installation and Configuration (Apache HTTP Server)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	11.1.2.4
CVE-2019-17563	Hyperion Infrastructure Technology	Common Security (Apache Tomcat)	HTTP	Yes	7.5	Network	High	None	Required	Un- changed	High	High	High	11.1.2.4	See Note 1
CVE-2019-12402	Hyperion Infrastructure Technology	Installation and Configuration (Apache Commons Compress)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	11.1.2.4
CVE-2020-5421	Hyperion Infrastructure Technology	Installation and Configuration (Spring Framework)	HTTP	No	6.5	Network	High	Low	Required	Changed	Low	High	None	11.1.2.4
CVE-2020-11022	Hyperion Financial Reporting	Installation (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	11.1.2.4	See Note 2
CVE-2019-12415	Hyperion Infrastructure Technology	Common Security (Apache POI)	None	No	5.5	Local	Low	Low	None	Un- changed	High	None	None	11.1.2.4

Notes:

This CVE is not exploitable in Hyperion Infrastructure Technology. The CVSS v3.1 Base Score for this CVE in the National Vulnerability Database (NVD) is 9.5. Tomcat is removed in Hyperion Infrastructure Technology with the January 2021 Critical Patch Update.
This CVE is not exploitable in Hyperion Financial Reporting. The CVSS v3.1 Base Score for this CVE in the National Vulnerability Database (NVD) is 6.1. jQuery is removed from Hyperion Financial Reporting with the January 2021 Critical Patch Update.

Additional CVEs addressed are:

The patch for CVE-2019-13990 also addresses CVE-2019-5427.
The patch for CVE-2020-11022 also addresses CVE-2020-11023.
The patch for CVE-2020-11984 also addresses CVE-2020-11993 and CVE-2020-9490.

Oracle Insurance Applications Risk Matrix

This Critical Patch Update contains 3 new security patches for Oracle Insurance Applications. 1 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-5421	Oracle Insurance Policy Administration	Architecture (Spring Framework)	HTTP	No	6.5	Network	High	Low	Required	Changed	Low	High	None	10.2.0, 10.2.4, 11.0.2, 11.1.0-11.3.0
CVE-2020-5421	Oracle Insurance Rules Palette	Architecture (Spring Framework)	HTTP	No	6.5	Network	High	Low	Required	Changed	Low	High	None	10.2.0, 10.2.4, 11.0.2, 11.1.0-11.3.0
CVE-2019-11358	Oracle Insurance Insbridge Rating and Underwriting	Framework Administrator IBFA (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	5.0.0.20, 5.1.1.03

Oracle Java SE Risk Matrix

This Critical Patch Update contains 1 new security patch for Oracle Java SE. This vulnerability is remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-14803	Java SE, Java SE Embedded	Libraries	Multiple	Yes	5.3	Network	Low	None	None	Un- changed	Low	None	None	Java SE: 7u281, 8u271; Java SE Embedded: 8u271	See Note 1

Notes:

This vulnerability applies to Java deployments that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security.

Oracle JD Edwards Risk Matrix

This Critical Patch Update contains 5 new security patches for Oracle JD Edwards. All of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-1967	JD Edwards EnterpriseOne Tools	Enterprise Infrastructure SEC (OpenSSL)	JDENET	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	Prior to 9.2.5.0
CVE-2020-11022	JD Edwards EnterpriseOne Orchestrator	E1 IOT Orchestrator Security (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	Prior to 9.2.5.0
CVE-2020-11022	JD Edwards EnterpriseOne Tools	E1 Dev Platform Tech – Cloud (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	Prior to 9.2.5.0
CVE-2020-11022	JD Edwards EnterpriseOne Tools	Web Runtime (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	Prior to 9.2.5.0
CVE-2021-2052	JD Edwards EnterpriseOne Orchestrator	E1 IOT Orchestrator Security	HTTP	Yes	5.8	Network	Low	None	None	Changed	Low	None	None	Prior to 9.2.5.1

Additional CVEs addressed are:

The patch for CVE-2020-11022 also addresses CVE-2020-11023.
The patch for CVE-2020-1967 also addresses CVE-2019-1551.

Oracle MySQL Risk Matrix

This Critical Patch Update contains 43 new security patches for Oracle MySQL. 5 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-13871	MySQL Workbench	Workbench (SQLite)	MySQL Workbench	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	8.0.22 and prior
CVE-2019-10086	MySQL Enterprise Monitor	Service Manager (Apache Commons BeanUtils)	HTTPS	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	8.0.22 and prior
CVE-2021-2046	MySQL Server	Server: Stored Procedure	MySQL Protocol	No	6.8	Network	Low	High	None	Changed	None	None	High	8.0.22 and prior
CVE-2020-5421	MySQL Enterprise Monitor	Service Manager (Spring Framework)	HTTPS	No	6.5	Network	High	Low	Required	Changed	Low	High	None	8.0.22 and prior
CVE-2020-5408	MySQL Enterprise Monitor	Service Manager (Spring Security)	HTTPS	No	6.5	Network	Low	Low	None	Un- changed	High	None	None	8.0.22 and prior
CVE-2021-2020	MySQL Server	Server: Optimizer	MySQL Protocol	No	6.5	Network	Low	Low	None	Un- changed	None	None	High	8.0.20 and prior
CVE-2021-2024	MySQL Server	Server: Optimizer	MySQL Protocol	No	6.5	Network	Low	Low	None	Un- changed	None	None	High	8.0.22 and prior
CVE-2021-2011	MySQL Client	C API	MySQL Protocol	Yes	5.9	Network	High	None	None	Un- changed	None	None	High	5.7.32 and prior, 8.0.22 and prior
CVE-2020-1971	MySQL Workbench	MySQL Workbench (OpenSSL)	MySQL Workbench	Yes	5.9	Network	High	None	None	Un- changed	None	None	High	8.0.22 and prior
CVE-2021-2006	MySQL Client	C API	MySQL Protocol	No	5.3	Network	High	Low	None	Un- changed	None	None	High	8.0.19 and prior
CVE-2021-2048	MySQL Server	InnoDB	MySQL Protocol	No	5.0	Network	High	High	None	Un- changed	None	Low	High	8.0.22 and prior
CVE-2021-2028	MySQL Server	InnoDB	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.21 and prior
CVE-2021-2122	MySQL Server	Server: DDL	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.22 and prior
CVE-2021-2058	MySQL Server	Server: Locking	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.22 and prior
CVE-2021-2001	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	5.6.50 and prior, 5.7.30 and prior, 8.0.17 and prior
CVE-2021-2016	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.19 and prior
CVE-2021-2021	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.22 and prior
CVE-2021-2030	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.21 and prior
CVE-2021-2031	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.22 and prior
CVE-2021-2036	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.22 and prior
CVE-2021-2055	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.21 and prior
CVE-2021-2060	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	5.6.50 and prior, 5.7.32 and prior, 8.0.22 and prior
CVE-2021-2070	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.22 and prior
CVE-2021-2076	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.22 and prior
CVE-2021-2065	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.22 and prior
CVE-2021-2014	MySQL Server	Server: PAM Auth Plugin	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	5.7.32 and prior
CVE-2021-2002	MySQL Server	Server: Replication	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.22 and prior
CVE-2021-2012	MySQL Server	Server: Security: Privileges	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.20 and prior
CVE-2021-2009	MySQL Server	Server: Security: Roles	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.19 and prior
CVE-2021-2072	MySQL Server	Server: Stored Procedure	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.22 and prior
CVE-2021-2081	MySQL Server	Server: Stored Procedure	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.22 and prior
CVE-2021-2022	MySQL Server	InnoDB	MySQL Protocol	No	4.4	Network	High	High	None	Un- changed	None	None	High	5.6.50 and prior, 5.7.32 and prior, 8.0.22 and prior
CVE-2021-2038	MySQL Server	Server: Components Services	MySQL Protocol	No	4.4	Network	High	High	None	Un- changed	None	None	High	8.0.22 and prior
CVE-2021-2061	MySQL Server	Server: DDL	MySQL Protocol	No	4.4	Network	High	High	None	Un- changed	None	None	High	8.0.22 and prior
CVE-2021-2056	MySQL Server	Server: DML	MySQL Protocol	No	4.4	Network	High	High	None	Un- changed	None	None	High	8.0.22 and prior
CVE-2021-2087	MySQL Server	Server: DML	MySQL Protocol	No	4.4	Local	Low	High	None	Un- changed	None	None	High	8.0.22 and prior
CVE-2021-2088	MySQL Server	Server: DML	MySQL Protocol	No	4.4	Local	Low	High	None	Un- changed	None	None	High	8.0.22 and prior
CVE-2021-2032	MySQL Server	Information Schema	MySQL Protocol	No	4.3	Network	Low	Low	None	Un- changed	Low	None	None	5.7.32 and prior, 8.0.22 and prior
CVE-2021-2010	MySQL Client	C API	MySQL Protocol	No	4.2	Network	High	Low	None	Un- changed	None	Low	Low	5.6.50 and prior, 5.7.32 and prior, 8.0.22 and prior
CVE-2021-1998	MySQL Server	Server: Optimizer	MySQL Protocol	No	3.8	Network	Low	High	None	Un- changed	None	Low	Low	8.0.20 and prior
CVE-2021-2007	MySQL Client	C API	MySQL Protocol	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	5.6.47 and prior, 5.7.29 and prior, 8.0.19 and prior
CVE-2021-2019	MySQL Server	Server: Security: Privileges	MySQL Protocol	No	2.7	Network	Low	High	None	Un- changed	Low	None	None	8.0.19 and prior
CVE-2021-2042	MySQL Server	InnoDB	MySQL Protocol	No	2.3	Local	Low	High	None	Un- changed	Low	None	None	8.0.21 and prior

Additional CVEs addressed are:

The patch for CVE-2020-13871 also addresses CVE-2020-11655, CVE-2020-11656, CVE-2020-15358 and CVE-2020-9327.
The patch for CVE-2020-5408 also addresses CVE-2020-5407.

Oracle PeopleSoft Risk Matrix

This Critical Patch Update contains 8 new security patches for Oracle PeopleSoft. 6 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2021-2063	PeopleSoft Enterprise PeopleTools	Portal	None	No	8.4	Local	Low	None	None	Un- changed	High	High	High	8.56, 8.57, 8.58
CVE-2021-2071	PeopleSoft Enterprise PeopleTools	Elastic Search	HTTP	Yes	8.1	Network	High	None	None	Un- changed	High	High	High	8.56, 8.57, 8.58
CVE-2019-0227	PeopleSoft Enterprise HCM Human Resources	Global Payroll for Switzerland (Apache Axis)	HTTP	Yes	7.5	Adjacent Network	High	None	None	Un- changed	High	High	High	9.2
CVE-2021-2044	PeopleSoft Enterprise FIN Payables	Financial Sanctions	HTTP	No	6.5	Network	Low	Low	None	Un- changed	High	None	None	9.2
CVE-2020-11022	PeopleSoft Enterprise HCM Human Resources	Company Dir / Org Chart Viewer, Employee Snapshot (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	9.2
CVE-2021-2043	PeopleSoft Enterprise PeopleTools	Portal	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.56, 8.57, 8.58
CVE-2020-9281	PeopleSoft Enterprise PeopleTools	Rich Text Editor (CKEditor)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.56, 8.57, 8.58
CVE-2020-1968	PeopleSoft Enterprise PeopleTools	Security (OpenSSL)	HTTPS	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	8.56, 8.57, 8.58

Additional CVEs addressed are:

The patch for CVE-2019-0227 also addresses CVE-2018-8032.
The patch for CVE-2020-11022 also addresses CVE-2020-11023.

Oracle Retail Applications Risk Matrix

This Critical Patch Update contains 32 new security patches for Oracle Retail Applications. 20 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-10683	Oracle Retail Customer Management and Segmentation Foundation	Segment (dom4j)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	16.0, 17.0, 18.0, 19.0
CVE-2020-9546	Oracle Retail Merchandising System	Foundation (jackson-databind)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	15.0
CVE-2020-9546	Oracle Retail Sales Audit	Rule Wizards (jackson-databind)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	14.1
CVE-2020-1945	Oracle Retail Extract Transform and Load	Mathematical Operators (Apache Ant)	HTTP	Yes	9.1	Network	Low	None	None	Un- changed	High	High	None	13.2.5, 13.2.8
CVE-2020-5421	Oracle Retail Order Broker	System Administration (Spring Framework)	HTTP	No	8.8	Network	Low	Low	None	Un- changed	High	High	High	15.0, 16.0
CVE-2017-8028	Oracle Retail Invoice Matching	Posting (Spring-LDAP)	HTTP	Yes	8.1	Network	High	None	None	Un- changed	High	High	High	13.2, 14.0, 14.1
CVE-2020-5398	Oracle Retail Bulk Data Integration	BDI Job Scheduler (Spring Framework)	HTTP	Yes	7.5	Network	High	None	Required	Un- changed	High	High	High	16.0.3
CVE-2020-11979	Oracle Retail Financial Integration	PeopleSoft Integration (Apache Ant)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	14.1.3, 15.0.3, 16.0.3
CVE-2020-11979	Oracle Retail Integration Bus	RIB Kernal (Apache Ant)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	14.1.3, 15.0.3, 16.0.3
CVE-2019-17566	Oracle Retail Integration Bus	RIB Kernal (Apache Batik)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	15.0.3
CVE-2019-17566	Oracle Retail Order Broker	System Administration (Apache Batik)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	15.0, 16.0
CVE-2020-11979	Oracle Retail Service Backbone	RSB kernel (Apache Ant)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	14.1.3, 15.0.3, 16.0.3
CVE-2020-11979	Oracle Retail Store Inventory Management	SIM Integration (Apache Ant)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	High	None	14.1.3.9, 15.0.3.0, 16.0.3.0
CVE-2019-10086	Oracle Retail Financial Integration	PeopleSoft Integration (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	14.1.3, 15.0.3, 16.0.3
CVE-2019-10086	Oracle Retail Integration Bus	RIB Kernal (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	14.1.3, 15.0.3, 16.0.3
CVE-2019-10086	Oracle Retail Order Broker	System Administration (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	15.0
CVE-2019-10086	Oracle Retail Service Backbone	RSB kernel (Apache Commons BeanUtils)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	14.1.3, 15.0.3, 16.0.3
CVE-2020-9484	Oracle Retail Order Broker	System Administration (Apache Tomcat)	None	No	7.0	Local	High	Low	None	Un- changed	High	High	High	15.0
CVE-2020-5421	Oracle Retail Assortment Planning	Application Core (Spring Framework)	HTTP	No	6.5	Network	High	Low	Required	Changed	Low	High	None	16.0.3
CVE-2020-5421	Oracle Retail Financial Integration	PeopleSoft Integration (Spring Framework)	HTTP	No	6.5	Network	High	Low	Required	Changed	High	Low	None	14.1.3, 15.0.3, 16.0.3
CVE-2020-5421	Oracle Retail Integration Bus	RIB Kernal (Spring Framework)	HTTP	No	6.5	Network	High	Low	Required	Changed	High	Low	None	14.1.3, 15.0.3, 16.0.3
CVE-2020-5421	Oracle Retail Invoice Matching	Security (Spring Framework)	HTTP	No	6.5	Network	High	Low	Required	Changed	High	Low	None	14.0, 14.1
CVE-2020-5421	Oracle Retail Service Backbone	RSB kernel (Spring Framework)	HTTP	No	6.5	Network	High	Low	Required	Changed	High	Low	None	14.1.3, 15.0.3, 16.0.3
CVE-2021-2057	Oracle Retail Customer Management and Segmentation Foundation	Internal Operations	HTTP	No	6.3	Network	Low	Low	None	Un- changed	Low	Low	Low	19.0
CVE-2019-17091	Oracle Retail Bulk Data Integration	BDI Job Scheduler (Eclipse Mojarra)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	16.0.3
CVE-2020-13954	Oracle Retail Order Broker Cloud Service	Supplier Direct Fulfillment (Apache CXF)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	15.0
CVE-2019-17091	Oracle Retail Store Inventory Management	SIM Integration (Eclipse Mojarra)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	14.0.4.0, 14.1.3.0, 15.0.3.0, 16.0.3.0
CVE-2020-17521	Oracle Retail Bulk Data Integration	BDI Job Scheduler (Apache Groovy)	None	No	5.5	Local	Low	Low	None	Un- changed	High	None	None	15.0.3, 16.0.3
CVE-2020-17521	Oracle Retail Financial Integration	PeopleSoft Integration Bugs (Apache Groovy)	None	No	5.5	Local	Low	Low	None	Un- changed	High	None	None	15.0.3, 16.0.3
CVE-2020-17521	Oracle Retail Integration Bus	RIB Kernal (Apache Groovy)	None	No	5.5	Local	Low	Low	None	Un- changed	High	None	None	15.0.3, 16.0.3
CVE-2020-17521	Oracle Retail Service Backbone	RSB kernel (Apache Groovy)	None	No	5.5	Local	Low	Low	None	Un- changed	High	None	None	15.0.3, 16.0.3
CVE-2020-9488	Oracle Retail Customer Management and Segmentation Foundation	Promotions (Apache Log4j)	HTTP	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	16.0, 17.0, 18.0, 19.0

Additional CVEs addressed are:

The patch for CVE-2020-1945 also addresses CVE-2017-5645.
The patch for CVE-2020-5398 also addresses CVE-2020-5421.
The patch for CVE-2020-9546 also addresses CVE-2020-10650, CVE-2020-10672, CVE-2020-10673, CVE-2020-10968, CVE-2020-10969, CVE-2020-11111, CVE-2020-11112, CVE-2020-11113, CVE-2020-11619, CVE-2020-11620, CVE-2020-9547 and CVE-2020-9548.

Oracle Siebel CRM Risk Matrix

This Critical Patch Update contains 4 new security patches for Oracle Siebel CRM. 1 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2021-2039	Siebel Core – Server Framework	Search	HTTP	No	7.6	Network	Low	Low	Required	Changed	High	Low	None	20.12 and prior
CVE-2020-9484	Siebel UI Framework	EAI (Apache Tomcat)	None	No	7.0	Local	High	Low	None	Un- changed	High	High	High	20.12 and prior
CVE-2020-11022	Siebel Mobile App	Open UI (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	20.12 and prior
CVE-2021-2004	Siebel Core – Server BizLogic Script	Integration – Scripting	HTTP	No	4.3	Network	Low	Low	None	Un- changed	Low	None	None	20.12 and prior

Additional CVEs addressed are:

The patch for CVE-2020-11022 also addresses CVE-2020-11023.
The patch for CVE-2020-9484 also addresses CVE-2020-11996, CVE-2020-13934, CVE-2020-13935, CVE-2020-1935 and CVE-2020-9488.

Oracle Supply Chain Risk Matrix

This Critical Patch Update contains 11 new security patches for Oracle Supply Chain. All of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2021-2102	Oracle Complex Maintenance, Repair, and Overhaul	Dialog Box	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	11.5.10, 12.1, 12.2
CVE-2021-2103	Oracle Complex Maintenance, Repair, and Overhaul	Dialog Box	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	11.5.10, 12.1, 12.2
CVE-2021-2104	Oracle Complex Maintenance, Repair, and Overhaul	Dialog Box	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	11.5.10, 12.1, 12.2
CVE-2021-2078	Oracle Configurator	UI Servlet	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1, 12.2
CVE-2021-2079	Oracle Configurator	UI Servlet	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1, 12.2
CVE-2021-2080	Oracle Configurator	UI Servlet	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1, 12.2
CVE-2020-14195	Oracle Agile PLM	Security (jackson-databind)	HTTP	Yes	8.1	Network	High	None	None	Un- changed	High	High	High	9.3.6
CVE-2019-17563	Oracle Agile Engineering Data Management	Install (Apache Tomcat)	HTTP	Yes	7.5	Network	High	None	Required	Un- changed	High	High	High	6.2.1.0
CVE-2020-9281	Oracle Agile PLM	Security (CKEditor)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	9.3.5, 9.3.6
CVE-2019-11358	Oracle Agile Product Lifecycle Management for Process	Installation (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	6.1
CVE-2019-11358	Oracle Transportation Management	Install (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	1.4.3

Additional CVEs addressed are:

The patch for CVE-2019-11358 also addresses CVE-2020-11022 and CVE-2020-11023.
The patch for CVE-2019-17563 also addresses CVE-2019-17569, CVE-2020-1935, CVE-2020-1938 and CVE-2020-9484.
The patch for CVE-2020-14195 also addresses CVE-2020-10650, CVE-2020-10672, CVE-2020-10673, CVE-2020-10968, CVE-2020-10969, CVE-2020-11111, CVE-2020-11112, CVE-2020-11113, CVE-2020-14060, CVE-2020-14061, CVE-2020-14062, CVE-2020-24616, CVE-2020-24750, CVE-2020-9546, CVE-2020-9547 and CVE-2020-9548.

Oracle Systems Risk Matrix

This Critical Patch Update contains 4 new security patches for Oracle Systems. 3 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-11984	Oracle ZFS Storage Appliance Kit	Operating System Image	Multiple	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	8.8
CVE-2020-11022	StorageTek Tape Analytics SW Tool	Software (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	2.3.1
CVE-2021-1999	Oracle ZFS Storage Appliance Kit	RAS subsystems	None	No	5.0	Local	High	High	Required	Changed	None	High	None	8.8
CVE-2020-9488	StorageTek Tape Analytics SW Tool	Software (Apache Log4j)	HTTP	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	2.3.1

Additional CVEs addressed are:

The patch for CVE-2020-11022 also addresses CVE-2020-11023.
The patch for CVE-2020-11984 also addresses CVE-2018-20781, CVE-2019-11135, CVE-2019-20892, CVE-2019-20907, CVE-2020-11985, CVE-2020-11993, CVE-2020-13254, CVE-2020-13596, CVE-2020-13871, CVE-2020-14422, CVE-2020-15025, CVE-2020-15358, CVE-2020-17498, CVE-2020-24583, CVE-2020-24584, CVE-2020-25862, CVE-2020-25863, CVE-2020-25866, CVE-2020-26575, CVE-2020-9490 and CVE-2021-1999.

Oracle Utilities Applications Risk Matrix

This Critical Patch Update contains 1 new security patch for Oracle Utilities Applications. This vulnerability is remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-2555	Oracle Utilities Framework	General (Oracle Coherence)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0-4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0

Oracle Virtualization Risk Matrix

This Critical Patch Update contains 17 new security patches for Oracle Virtualization. None of these vulnerabilities may be remotely exploitable without authentication, i.e., none may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2021-2074	Oracle VM VirtualBox	Core	None	No	8.2	Local	Low	High	None	Changed	High	High	High	Prior to 6.1.18
CVE-2021-2129	Oracle VM VirtualBox	Core	None	No	7.9	Local	Low	High	None	Changed	High	High	None	Prior to 6.1.18
CVE-2021-2128	Oracle VM VirtualBox	Core	None	No	6.5	Local	Low	Low	None	Changed	High	None	None	Prior to 6.1.18
CVE-2021-2086	Oracle VM VirtualBox	Core	None	No	6.0	Local	Low	High	None	Changed	None	None	High	Prior to 6.1.18
CVE-2021-2111	Oracle VM VirtualBox	Core	None	No	6.0	Local	Low	High	None	Changed	None	None	High	Prior to 6.1.18
CVE-2021-2112	Oracle VM VirtualBox	Core	None	No	6.0	Local	Low	High	None	Changed	None	None	High	Prior to 6.1.18
CVE-2021-2121	Oracle VM VirtualBox	Core	None	No	6.0	Local	Low	High	None	Changed	None	None	High	Prior to 6.1.18
CVE-2021-2124	Oracle VM VirtualBox	Core	None	No	6.0	Local	Low	High	None	Changed	None	None	High	Prior to 6.1.18
CVE-2021-2119	Oracle VM VirtualBox	Core	None	No	6.0	Local	Low	High	None	Changed	High	None	None	Prior to 6.1.18
CVE-2021-2120	Oracle VM VirtualBox	Core	None	No	6.0	Local	Low	High	None	Changed	High	None	None	Prior to 6.1.18
CVE-2021-2126	Oracle VM VirtualBox	Core	None	No	6.0	Local	Low	High	None	Changed	None	High	None	Prior to 6.1.18
CVE-2021-2131	Oracle VM VirtualBox	Core	None	No	6.0	Local	Low	High	None	Changed	None	High	None	Prior to 6.1.18
CVE-2021-2125	Oracle VM VirtualBox	Core	None	No	4.6	Local	Low	High	None	Changed	Low	Low	None	Prior to 6.1.18
CVE-2021-2073	Oracle VM VirtualBox	Core	None	No	4.4	Local	Low	High	None	Un- changed	None	None	High	Prior to 6.1.18
CVE-2021-2127	Oracle VM VirtualBox	Core	None	No	4.4	Local	Low	High	None	Un- changed	None	None	High	Prior to 6.1.18
CVE-2021-2130	Oracle VM VirtualBox	Core	None	No	4.4	Local	Low	High	None	Un- changed	None	None	High	Prior to 6.1.18
CVE-2021-2123	Oracle VM VirtualBox	Core	None	No	3.2	Local	Low	High	None	Changed	Low	None	None	Prior to 6.1.18

No Related Posts

Oracle Critical Patch Update Advisory – October 2020

October 19, 2020September 28, 2021 Oracle Leave a comment

Oracle Critical Patch Update Advisory – October 2020

Description

Starting with the October 2020 Critical Patch Update, Oracle lists updates that address vulnerabilities in third-party components which are not exploitable in the context of their inclusion in their respective Oracle product beneath the product’s risk matrix. Oracle has published two versions of the October 2020 Critical Patch Update Advisory: this version of the advisory implemented the change in how non-exploitable vulnerabilities in third-party components are reported, and the “traditional” advisory follows the same format as the previous advisories. The “traditional” advisory is published at https://www.oracle.com/security-alerts/cpuoct2020traditional.html.

This Critical Patch Update contains 403 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at October 2020 Critical Patch Update: Executive Summary and Analysis.

Affected Products and Patch Information

Security vulnerabilities addressed by this Critical Patch Update affect the products listed below. The product area is shown in the Patch Availability Document column.

Please click on the links in the Patch Availability Document column below to access the documentation for patch availability information and installation instructions.

Affected Products and Versions	Patch Availability Document
Application Performance Management (APM), versions 13.3.0.0, 13.4.0.0	Enterprise Manager
Big Data Spatial and Graph, versions prior to 3.0	Database
Enterprise Manager Base Platform, versions 13.2.1.0, 13.3.0.0, 13.4.0.0	Enterprise Manager
Enterprise Manager for Peoplesoft, version 13.4.1.1	Enterprise Manager
Enterprise Manager for Storage Management, versions 13.3.0.0, 13.4.0.0	Enterprise Manager
Enterprise Manager Ops Center, version 12.4.0.0	Enterprise Manager
Fujitsu M10-1, M10-4, M10-4S, M12-1, M12-2, M12-2S Servers, versions prior to XCP2362, prior to XCP3090	Systems
Fujitsu M12-1, M12-2, M12-2S Servers, versions prior to XCP3090	Systems
Hyperion Analytic Provider Services, version 11.1.2.4	Fusion Middleware
Hyperion BI+, version 11.1.2.4	Fusion Middleware
Hyperion Essbase, version 11.1.2.4	Fusion Middleware
Hyperion Infrastructure Technology, version 11.1.2.4	Fusion Middleware
Hyperion Lifecycle Management, version 11.1.2.4	Fusion Middleware
Hyperion Planning, version 11.1.2.4	Fusion Middleware
Identity Manager Connector, version 9.0	Fusion Middleware
Instantis EnterpriseTrack, versions 17.1, 17.2, 17.3	Oracle Construction and Engineering Suite
Management Pack for Oracle GoldenGate, version 12.2.1.2.0	Fusion Middleware
MySQL Cluster, versions 7.3.30 and prior, 7.4.29 and prior, 7.5.19 and prior, 7.6.15 and prior, 8.0.21 and prior	MySQL
MySQL Enterprise Monitor, versions 8.0.21 and prior	MySQL
MySQL Server, versions 5.6.49 and prior, 5.7.31 and prior, 8.0.21 and prior	MySQL
MySQL Workbench, versions 8.0.21 and prior	MySQL
Oracle Access Manager, version 11.1.2.3.0	Fusion Middleware
Oracle Agile PLM, versions 9.3.3, 9.3.5, 9.3.6	Oracle Supply Chain Products
Oracle Agile Product Lifecycle Management for Process, version 6.2.0.0	Oracle Supply Chain Products
Oracle Application Express, versions prior to 20.2	Database
Oracle Application Testing Suite, version 13.3.0.1	Enterprise Manager
Oracle Banking Corporate Lending, versions 12.3.0, 14.0.0-14.4.0	Oracle Financial Services Applications
Oracle Banking Digital Experience, versions 18.1, 18.2, 18.3, 19.1, 19.2, 20.1	Oracle Financial Services Applications
Oracle Banking Payments, versions 14.1.0-14.4.0	Oracle Financial Services Applications
Oracle Banking Platform, versions 2.4.0-2.10.0	Oracle Banking Platform
Oracle BI Publisher, versions 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Oracle Business Intelligence Enterprise Edition, versions 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Oracle Business Process Management Suite, versions 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Oracle Communications Application Session Controller, versions 3.8m0, 3.9m0p1	Oracle Communications Application Session Controller
Oracle Communications Billing and Revenue Management, versions 7.5.0.23.0, 12.0.0.2.0, 12.0.0.3.0	Oracle Communications Billing and Revenue Management
Oracle Communications BRM – Elastic Charging Engine, versions 11.3.0.9.0, 12.0.0.3.0	Oracle Communications BRM – Elastic Charging Engine
Oracle Communications Diameter Signaling Router (DSR), versions 8.0.0.0-8.4.0.5, [IDIH] 8.0.0-8.2.2	Oracle Communications Diameter Signaling Router
Oracle Communications EAGLE Software, versions 46.6.0-46.8.2	Oracle Communications EAGLE
Oracle Communications Element Manager, versions 8.2.0-8.2.2	Oracle Communications Element Manager
Oracle Communications Evolved Communications Application Server, version 7.1	Oracle Communications Evolved Communications Application Server
Oracle Communications Messaging Server, version 8.1	Oracle Communications Messaging Server
Oracle Communications Offline Mediation Controller, version 12.0.0.3.0	Oracle Communications Offline Mediation Controller
Oracle Communications Services Gatekeeper, version 7	Oracle Communications Services Gatekeeper
Oracle Communications Session Border Controller, versions 8.2-8.4	Oracle Communications Session Border Controller
Oracle Communications Session Report Manager, versions 8.2.0-8.2.2	Oracle Communications Session Report Manager
Oracle Communications Session Route Manager, versions 8.2.0-8.2.2	Oracle Communications Session Route Manager
Oracle Communications Unified Inventory Management, versions 7.3.0, 7.4.0	Oracle Communications Unified Inventory Management
Oracle Communications WebRTC Session Controller, version 7.2	Oracle Communications WebRTC Session Controller
Oracle Data Integrator, versions 11.1.1.9.0, 12.2.1.3.0	Fusion Middleware
Oracle Database Server, versions 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, 19c	Database
Oracle E-Business Suite, versions 12.1.1-12.1.3, 12.2.3-12.2.10	E-Business Suite
Oracle Endeca Information Discovery Integrator, version 3.2.0	Fusion Middleware
Oracle Endeca Information Discovery Studio, version 3.2.0	Fusion Middleware
Oracle Enterprise Repository, version 11.1.1.7.0	Fusion Middleware
Oracle Enterprise Session Border Controller, version 8.4	Oracle Enterprise Session Border Controller
Oracle Financial Services Analytical Applications Infrastructure, versions 8.0.6-8.1.0	Oracle Financial Services Analytical Applications Infrastructure
Oracle Financial Services Analytical Applications Reconciliation Framework, versions 8.0.6-8.0.8, 8.1.0	Oracle Financial Services Analytical Applications Reconciliation Framework
Oracle Financial Services Asset Liability Management, versions 8.0.6, 8.0.7, 8.1.0	Oracle Financial Services Asset Liability Management
Oracle Financial Services Balance Sheet Planning, version 8.0.8	Oracle Financial Services Balance Sheet Planning
Oracle Financial Services Basel Regulatory Capital Basic, versions 8.0.6-8.0.8, 8.1.0	Oracle Financial Services Basel Regulatory Capital Basic
Oracle Financial Services Basel Regulatory Capital Internal Ratings Based Approach, versions 8.0.6-8.0.8, 8.1.0	Oracle Financial Services Basel Regulatory Capital Internal Ratings Based Approach
Oracle Financial Services Data Foundation, versions 8.0.6-8.1.0	Oracle Financial Services Data Foundation
Oracle Financial Services Data Governance for US Regulatory Reporting, versions 8.0.6-8.0.9	Oracle Financial Services Data Governance for US Regulatory Reporting
Oracle Financial Services Data Integration Hub, versions 8.0.6, 8.0.7, 8.1.0	Oracle Financial Services Data Integration Hub
Oracle Financial Services Funds Transfer Pricing, versions 8.0.6, 8.0.7, 8.1.0	Oracle Financial Services Funds Transfer Pricing
Oracle Financial Services Hedge Management and IFRS Valuations, versions 8.0.6-8.0.8, 8.1.0	Oracle Financial Services Hedge Management and IFRS Valuations
Oracle Financial Services Institutional Performance Analytics, versions 8.0.6, 8.0.7, 8.1.0, 8.7.0	Oracle Financial Services Institutional Performance Analytics
Oracle Financial Services Liquidity Risk Management, version 8.0.6	Oracle Financial Services Liquidity Risk Management
Oracle Financial Services Liquidity Risk Measurement and Management, versions 8.0.7, 8.0.8, 8.1.0	Oracle Financial Services Liquidity Risk Measurement and Management
Oracle Financial Services Loan Loss Forecasting and Provisioning, versions 8.0.6-8.0.8, 8.1.0	Oracle Financial Services Loan Loss Forecasting and Provisioning
Oracle Financial Services Market Risk Measurement and Management, versions 8.0.6, 8.0.8, 8.1.0	Oracle Financial Services Market Risk Measurement and Management
Oracle Financial Services Price Creation and Discovery, versions 8.0.6, 8.0.7	Oracle Financial Services Price Creation And Discovery
Oracle Financial Services Profitability Management, versions 8.0.6, 8.0.7, 8.1.0	Oracle Financial Services Profitability Management
Oracle Financial Services Regulatory Reporting for European Banking Authority, versions 8.0.6-8.1.0	Oracle Financial Services Regulatory Reporting for European Banking Authority
Oracle Financial Services Regulatory Reporting for US Federal Reserve, versions 8.0.6-8.0.9	Oracle Financial Services Regulatory Reporting for US Federal Reserve
Oracle Financial Services Regulatory Reporting with AgileREPORTER, version 8.0.9.2.0	Oracle Financial Services Regulatory Reporting with AgileREPORTER
Oracle Financial Services Retail Customer Analytics, version 8.0.6	Oracle Financial Services Retail Customer Analytics
Oracle FLEXCUBE Core Banking, versions 5.2.0, 11.5.0-11.7.0	Oracle Financial Services Applications
Oracle FLEXCUBE Direct Banking, versions 12.0.1, 12.0.2, 12.0.3	Oracle Financial Services Applications
Oracle FLEXCUBE Private Banking, versions 12.0.0, 12.1.0	Oracle Financial Services Applications
Oracle FLEXCUBE Universal Banking, versions 12.3.0, 14.0.0-14.4.0	Oracle Financial Services Applications
Oracle GoldenGate Application Adapters, versions 12.3.2.1.0, 19.1.0.0.0	Fusion Middleware
Oracle GraalVM Enterprise Edition, versions 19.3.3, 20.2.0	Oracle GraalVM Enterprise Edition
Oracle Health Sciences Empirica Signal, version 9.0	Health Sciences
Oracle Healthcare Data Repository, version 7.0.1	Health Sciences
Oracle Healthcare Foundation, versions 7.1.1, 7.2.0, 7.2.1, 7.3.0	Health Sciences
Oracle Hospitality Guest Access, versions 4.2.0, 4.2.1	Oracle Hospitality Guest Access
Oracle Hospitality Materials Control, version 18.1	Oracle Hospitality Materials Control
Oracle Hospitality OPERA 5 Property Services, versions 5.5, 5.6	Oracle Hospitality OPERA 5 Property Services
Oracle Hospitality Reporting and Analytics, version 9.1.0	Oracle Hospitality Reporting and Analytics
Oracle Hospitality RES 3700, version 5.7	Oracle Hospitality RES
Oracle Hospitality Simphony, versions 18.1, 18.2, 19.1.0-19.1.2	Oracle Hospitality Simphony
Oracle Hospitality Suite8, versions 8.10.2, 8.11-8.14	Oracle Hospitality Suite8
Oracle HTTP Server, versions 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Oracle Insurance Accounting Analyzer, version 8.0.9	Oracle Insurance Accounting Analyzer
Oracle Insurance Allocation Manager for Enterprise Profitability, versions 8.0.8, 8.1.0	Oracle Insurance Allocation Manager for Enterprise Profitability
Oracle Insurance Data Foundation, versions 8.0.6-8.1.0	Oracle Insurance Data Foundation
Oracle Insurance Insbridge Rating and Underwriting, versions 5.0.0.0-5.6.0.0, 5.6.1.0	Oracle Insurance Applications
Oracle Insurance Policy Administration J2EE, versions 10.2.0.37, 10.2.4.12, 11.0.2.25, 11.1.0.15, 11.2.0.26, 11.2.2.0	Oracle Insurance Applications
Oracle Insurance Rules Palette, versions 10.2.0.37, 10.2.4.12, 11.0.2.25, 11.1.0.15, 11.2.0.26	Oracle Insurance Applications
Oracle Java SE, versions 7u271, 8u261, 11.0.8, 15	Java SE
Oracle Java SE Embedded, version 8u261	Java SE
Oracle JDeveloper, versions 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Oracle Managed File Transfer, versions 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Oracle Outside In Technology, versions 8.5.4, 8.5.5	Fusion Middleware
Oracle Policy Automation, versions 12.2.0-12.2.20	Oracle Policy Automation
Oracle Policy Automation Connector for Siebel, version 10.4.6	Oracle Policy Automation
Oracle Policy Automation for Mobile Devices, versions 12.2.0-12.2.20	Oracle Policy Automation
Oracle REST Data Services, versions 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, 19c, [Standalone ORDS] prior to 20.2.1	Database
Oracle Retail Advanced Inventory Planning, version 14.1	Retail Applications
Oracle Retail Assortment Planning, versions 15.0.3.0, 16.0.3.0	Retail Applications
Oracle Retail Back Office, versions 14.0, 14.1	Retail Applications
Oracle Retail Bulk Data Integration, versions 15.0.3.0, 16.0.3.0	Retail Applications
Oracle Retail Central Office, versions 14.0, 14.1	Retail Applications
Oracle Retail Customer Management and Segmentation Foundation, versions 18.0, 19.0	Retail Applications
Oracle Retail Integration Bus, versions 14.1, 15.0, 16.0	Retail Applications
Oracle Retail Order Broker, versions 15.0, 16.0, 18.0, 19.0, 19.1, 19.2, 19.3	Retail Applications
Oracle Retail Point-of-Service, versions 14.0, 14.1	Retail Applications
Oracle Retail Predictive Application Server, versions 14.1.3.0, 15.0.3.0, 16.0.3.0	Retail Applications
Oracle Retail Price Management, versions 14.0.4, 14.1.3.0, 15.0.3.0, 16.0.3.0	Retail Applications
Oracle Retail Returns Management, versions 14.0, 14.1	Retail Applications
Oracle Retail Service Backbone, versions 14.1, 15.0, 16.0	Retail Applications
Oracle Retail Xstore Point of Service, versions 15.0.3, 16.0.5, 17.0.3, 18.0.2, 19.0.1	Retail Applications
Oracle Solaris, versions 10, 11	Systems
Oracle TimesTen In-Memory Database, versions prior to 11.2.2.8.49, prior to 18.1.3.1.0, prior to 18.1.4.1.0	Database
Oracle Transportation Management, version 6.3.7	Oracle Supply Chain Products
Oracle Utilities Framework, versions 2.2.0.0.0, 4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0-4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0	Oracle Utilities Applications
Oracle VM VirtualBox, versions prior to 6.1.16	Virtualization
Oracle WebCenter Portal, versions 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Oracle WebLogic Server, versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0	Fusion Middleware
Oracle ZFS Storage Appliance Kit, version 8.8	Systems
PeopleSoft Enterprise HCM Global Payroll Core, version 9.2	PeopleSoft
PeopleSoft Enterprise PeopleTools, versions 8.56, 8.57, 8.58	PeopleSoft
PeopleSoft Enterprise SCM eSupplier Connection, version 9.2	PeopleSoft
Primavera Gateway, versions 16.2.0-16.2.11, 17.12.0-17.12.8	Oracle Construction and Engineering Suite
Primavera Unifier, versions 16.1, 16.2, 17.7-17.12, 18.8, 19.12	Oracle Construction and Engineering Suite
Siebel Applications, versions 20.7, 20.8	Siebel

Note:

Vulnerabilities affecting either Oracle Database or Oracle Fusion Middleware may affect Oracle Fusion Applications, so Oracle customers should refer to Oracle Fusion Applications Critical Patch Update Knowledge Document, My Oracle Support Note 1967316.1 for information on patches to be applied to Fusion Application environments.
Vulnerabilities affecting Oracle Solaris may affect Oracle ZFSSA so Oracle customers should refer to the Oracle and Sun Systems Product Suite Critical Patch Update Knowledge Document, My Oracle Support Note 2160904.1 for information on minimum revisions of security patches required to resolve ZFSSA issues published in Critical Patch Updates and Solaris Third Party bulletins.
Solaris Third Party Bulletins are used to announce security patches for third party software distributed with Oracle Solaris. Solaris 10 customers should refer to the latest patch-sets which contain critical security fixes and detailed in Systems Patch Availability Document. Please see Reference Index of CVE IDs and Solaris Patches (My Oracle Support Note 1448883.1) for more information.
Users running Java SE with a browser can download the latest release from https://java.com. Users on the Windows and Mac OS X platforms can also use automatic updates to get the latest release.

Risk Matrix Content

Security vulnerabilities are scored using CVSS version 3.1 (see Oracle CVSS Scoring for an explanation of how Oracle applies CVSS version 3.1).

Workarounds

Skipped Critical Patch Updates

Critical Patch Update Supported Products and Versions

Credit Statement

The following people or organizations reported security vulnerabilities addressed by this Critical Patch Update to Oracle:

0rich1 Ant Security FG Lab: CVE-2020-14841
Aaron Carreras of FireEye: CVE-2020-14871
Abdulrahman Nour of Redforce: CVE-2020-14823
Ahmed Elhady Mohamed of Ahmed Mohamed: CVE-2020-14768
Akshay Gaikwad: CVE-2020-14762
Alessandro Bosco of TIM S.p.A: CVE-2020-14842, CVE-2020-14843
Alexander Kornbrust of Red Database Security: CVE-2020-14742, CVE-2020-14901
Alves Christopher of Telecom Nancy: CVE-2020-14867
Ammarit Thongthua of Secure D Center Cybersecurity Team: CVE-2020-14778
Amy Tran: CVE-2020-14822, CVE-2020-14831, CVE-2020-14833, CVE-2020-14834, CVE-2020-14849, CVE-2020-14850, CVE-2020-14851, CVE-2020-14856, CVE-2020-14857
Andrej Simko of Accenture: CVE-2020-14774, CVE-2020-14808
Anonymous researcher working with Trend Micro’s Zero Day Initiative: CVE-2020-14841, CVE-2020-14881, CVE-2020-14884, CVE-2020-14885, CVE-2020-14886
Bui Duong from Viettel Cyber Security: CVE-2020-14879, CVE-2020-14880
Chi Tran: CVE-2020-14822, CVE-2020-14831, CVE-2020-14833, CVE-2020-14834, CVE-2020-14849, CVE-2020-14850, CVE-2020-14851, CVE-2020-14856, CVE-2020-14857
codeplutos of AntGroup FG Security Lab: CVE-2020-14825
Damian Bury: CVE-2020-14767, CVE-2020-14770
Darragh Duffy: CVE-2020-14744
Eddie Zhu of Beijing DBSEC Technology Co., Ltd: CVE-2020-14741
Edoardo Predieri of TIM S.p.A: CVE-2020-14842, CVE-2020-14843
Fabio Minarelli of TIM S.p.A: CVE-2020-14842, CVE-2020-14843
Filip Ceglik: CVE-2020-14772
Francesco Russo of TIM S.p.A: CVE-2020-14842, CVE-2020-14843
François Goichon of Google: CVE-2020-14735
Gaoning Pan of Zhejiang University & Ant Security Light-Year Lab: CVE-2020-14872, CVE-2020-14892
Graham Rymer of University Information Services, University of Cambridge: CVE-2020-14840
Hangfan Zhang: CVE-2020-14828
Ioannis Charalambous of NCC Group: CVE-2020-14787, CVE-2020-14788
Ivo Palazzolo of Daimler TSS: CVE-2020-14864
Jacob Thompson of FireEye: CVE-2020-14871
Jakub Palaczynski: CVE-2020-14740, CVE-2020-14752
Jakub Plusczok: CVE-2020-14854
Jeffrey Martin of Rapid7: CVE-2020-14871
Joe Almeida of Globlue Technologies: CVE-2020-14815
Julien Zhan of Telecom Nancy: CVE-2020-14867
Khuyen Nguyen of secgit.com: CVE-2020-14816, CVE-2020-14817, CVE-2020-14819, CVE-2020-14835
Kritsada Sunthornwutthikrai of Secure D Center Cybersecurity Team: CVE-2020-14778
Kylinking of NSFocus Security Team: CVE-2020-14841
Larry W. Cashdollar: CVE-2020-14758, CVE-2020-14759
Le Xuan Tuyen – VNPT ISC working with Trend Micro Zero Day Initiative: CVE-2020-14841, CVE-2020-14859
Long Nguyễn Hữu Vũ: CVE-2020-14863
Longofo of Knownsec 404 Team: CVE-2020-14841
Luca Di Giuseppe of TIM S.p.A: CVE-2020-14842, CVE-2020-14843
Markus Loewe: CVE-2020-14796, CVE-2020-14797, CVE-2020-14798
Massimiliano Brolli of TIM S.p.A: CVE-2020-14842, CVE-2020-14843
Mateusz Dabrowski: CVE-2020-14784
Philippe Antoine of Telecom Nancy: CVE-2020-14867
Piotr Madej of ING Tech Poland: CVE-2020-14740
Preeyakorn Keadsai of Secure D Center Cybersecurity Team: CVE-2020-14778
Quynh Le of VNPT ISC working with Trend Micro Zero Day Initiative: CVE-2020-14825
r0 from A-TEAM of Legendsec at Qi’anxin Group: CVE-2020-14841
Roger Meyer: CVE-2020-14745
Rui Zhong: CVE-2020-14828
Sergey Ostanin: CVE-2020-14781
Shiva Gupta of Shiva Hacker One: CVE-2020-14890, CVE-2020-14897
Spyridon Chatzimichail of OTE Hellenic Telecommunications Organization S.A.: CVE-2020-14764
Thai Nguyen of ECQ: CVE-2020-14826
thiscodecc: CVE-2020-14825
Tomasz Stachowicz: CVE-2020-14780
Trung Le: CVE-2020-14822, CVE-2020-14831, CVE-2020-14833, CVE-2020-14834, CVE-2020-14849, CVE-2020-14850, CVE-2020-14851, CVE-2020-14856, CVE-2020-14857
Tuan Anh Nguyen of Viettel Cyber Security: CVE-2020-14855, CVE-2020-14862, CVE-2020-14875
Tuan Anh Nguyen of Viettel Cyber Security working with Trend Micro Zero Day Initiative: CVE-2020-14876
Ved Prabhu: CVE-2020-14762, CVE-2020-14763, CVE-2020-14898, CVE-2020-14899, CVE-2020-14900
Venustech ADLab: CVE-2020-14820
Viktor Gazdag of NCC Group: CVE-2020-14787, CVE-2020-14788
voidfyoo of Chaitin Security Research Lab: CVE-2020-14882, CVE-2020-14883
Walid Faour: CVE-2020-14783
Xingwei Lin of Ant Security Light-Year Lab: CVE-2020-14872, CVE-2020-14889, CVE-2020-14892
Xinlei Ying of Ant Security Light-Year Lab: CVE-2020-14892
Xu Yuanzhen of Alibaba Cloud Security Team: CVE-2020-14841
Yaoguang Chen of Ant Security Light-Year Lab: CVE-2020-14828, CVE-2020-14861, CVE-2020-14893
Yi Ren of Alibaba: CVE-2020-14790, CVE-2020-14828
Yongheng Chen: CVE-2020-14828
Yu Wang of BMH Security Team: CVE-2020-14841
Yuyue Wang of Alibaba: CVE-2020-14828
Zhiqiang Zang of University of Texas at Austin: CVE-2020-14792
Zouhair Janatil-Idrissi of Telecom Nancy: CVE-2020-14867

Security-In-Depth Contributors

In this Critical Patch Update, Oracle recognizes the following for contributions to Oracle’s Security-In-Depth program.:

Amy Tran [35 reports]
Chi Tran [35 reports]
David Wilkins
Markus Loewe [2 reports]
Mateusz Dabrowski
Trung Le [35 reports]

On-Line Presence Security Contributors

For this quarter, Oracle recognizes the following for contributions to Oracle’s On-Line Presence Security program:

Abdulrahman Ahmed [3 reports]
Abhishek Morla
Adam Willard [2 reports]
Adam Willard of Raytheon Foreground Security
Adarsh VS Mannarakkal
Ahmed Elmalky
Ahmed Omer Morve
Ai Ho (j3ssiejjj)
Alex Munene
Alisha Sheikh
Anil Bhatt
Anurag Kumar Rawat (A1C3VENOM)
Ayan Saha
Badal Sardhara
Bindiya Sardhara
Bui Dinh Bao aka 0xd0ff9 of Zalo Security Team (VNG Corp).
Danny
Dhiraj Mishra
Funny Tech
Gaurav Kumar
Gourab Sadhukhan
Harsh Mukeshbhai Joshi [2 reports]
Himanshu Phulwariya
Karthick Selvaraj
Kartik Sharma
Kaustubh Kale
Kirtan Patel
Kryptos Logic – Threat Intelligence Platform
Kunal Gambhir
Magrabur Alam Sofily
Mansouri Badis
Marwan Ali Albahar [2 reports]
Matthew Harlow of EthicalHacker 20
Mayank Kumar
Mayank Malik, Kartik Sharma
Micah Van Deusen
Omkar Ghaisas
Osman Ahmed Hassan
Pankaj Kumar Thakur from Nepal [3 reports]
Pratish Bhansali
Ria from iZOOlogic
Riccardo Donini
Rick Verdoes & Danny de Weille of HackDefense
Robert Lee Dick [2 reports]
Roger Meyer
Ronak Nahar
Rudi Andriano
Ryan awsmhacks Preston
Sai Prashanth Pulisetti
Sameer Goyal
Shahid Ahmed [2 reports]
Shivang Trivedi [2 reports]
Shubham Kalaria
Shubham Maheshwari
Sidney Omondi of Salaam Technology
Siva Pathela
Soumajit Mukherjee
Sparsh Gupta
Srikar V – exp1o1t9r
Sumit Sah
Supun Madubashana Halangoda
Suresh Nadar
Swapnil Maurya – “swapmaurya20”
Syed Muhammad Asim [2 reports]
Vaibhav Gaikwad of Knock Security Solutions
Venkata Sateesh Netti (str4n63r)
Walid Hossain
Yassine Triki
Yatin Sharma

Critical Patch Update Schedule

Critical Patch Updates are released on the Tuesday closest to the 17th day of January, April, July and October. The next four dates are:

19 January 2021
20 April 2021
20 July 2021
19 October 2021

References

Modification History

Date	Note
2020-December-8	Rev 6. Added a note for CVE-2020-14871.
2020-November-16	Rev 5. Updated Oracle ZFS Storage Appliance Kit row to include CVE-2020-14871.
2020-October-29	Rev 4. Added CVE-2018-2765.
2020-October-27	Rev 3. Credit statement update.
2020-October-22	Rev 2. Affected versions change for CVE-2020-14807, CVE-2020-14810 and credit statement update.
2020-October-20	Rev 1. Initial Release.

Oracle Database Products Risk Matrices

This Critical Patch Update contains 29 new security patches for Oracle Database Products divided as follows:

19 new security patches for Oracle Database Products
1 new security patch for Oracle Big Data Graph
5 new security patches for Oracle REST Data Services
4 new security patches for Oracle TimesTen In-Memory Database

Oracle Database Server Risk Matrix

This Critical Patch Update contains 19 new security patches plus additional third party patches noted below for Oracle Database Products. 5 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. 1 of these patches is applicable to client-only installations, i.e., installations that do not have the Oracle Database Server installed. The English text form of this Risk Matrix can be found here.

CVE#	Component	Package and/or Privilege Required	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Component	Package and/or Privilege Required	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2019-12900	Core RDBMS (bzip2)	DBA Level Account	Oracle Net	No	8.8	Network	Low	Low	None	Un- changed	High	High	High	11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, 19c
CVE-2020-14735	Scheduler	Local Logon	None	No	8.8	Local	Low	Low	None	Changed	High	High	High	11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, 19c
CVE-2020-14734	Oracle Text	None	Oracle Net	Yes	8.1	Network	High	None	None	Un- changed	High	High	High	11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, 19c
CVE-2018-2765	Oracle SSL API	None	HTTPS	Yes	7.5	Network	Low	None	None	Un- changed	High	None	None	11.2.0.4, 12.1.0.2, 12.2.0.1
CVE-2020-13935	Workload Manager (Apache Tomcat)	None	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	12.2.0.1, 18c, 19c
CVE-2020-11023	Oracle Application Express (jQuery)	None	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	Prior to 20.2
CVE-2020-11023	ORDS (jQuery)	None	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, 19c	See Note 1
CVE-2020-14762	Oracle Application Express	SQL Workshop	HTTP	No	5.4	Network	Low	Low	Required	Changed	Low	Low	None	Prior to 20.2
CVE-2020-9281	Oracle Application Express	Valid User Account	HTTP	No	5.4	Network	Low	Low	Required	Changed	Low	Low	None	Prior to 20.2
CVE-2020-14899	Oracle Application Express Data Reporter	Valid User Account	HTTP	No	5.4	Network	Low	Low	Required	Changed	Low	Low	None	Prior to 20.2
CVE-2020-14900	Oracle Application Express Group Calendar	Valid User Account	HTTP	No	5.4	Network	Low	Low	Required	Changed	Low	Low	None	Prior to 20.2
CVE-2020-14898	Oracle Application Express Packaged Apps	Valid User Account	HTTP	No	5.4	Network	Low	Low	Required	Changed	Low	Low	None	Prior to 20.2
CVE-2020-14763	Oracle Application Express Quick Poll	Valid User Account	HTTP	No	5.4	Network	Low	Low	Required	Changed	Low	Low	None	Prior to 20.2
CVE-2020-14741	Database Filesystem	Resource, Create Table, Create View, Create Procedure, Dbfs_role	Oracle Net	No	4.9	Network	Low	High	None	Un- changed	None	None	High	11.2.0.4, 12.1.0.2, 12.2.0.1
CVE-2020-14901	RDBMS Security	Analyze Any	Oracle Net	No	4.9	Network	Low	High	None	Un- changed	High	None	None	19c
CVE-2020-14736	Database Vault	Create Public Synonym	Oracle Net	No	3.8	Network	Low	High	None	Un- changed	Low	Low	None	11.2.0.4, 12.1.0.2, 12.2.0.1
CVE-2020-14743	Java VM	Create Procedure	Multiple	No	3.1	Network	High	Low	None	Un- changed	None	Low	None	11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, 19c
CVE-2020-14740	SQL Developer Install	Client Computer User Account	Local Logon	No	2.8	Local	Low	Low	Required	Un- changed	Low	None	None	11.2.0.4, 12.1.0.2, 12.2.0.1, 18c
CVE-2020-14742	Core RDBMS	SYSDBA level account	Oracle Net	No	2.7	Network	Low	High	None	Un- changed	None	Low	None	11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, 19c

Notes:

Additional ORDS bugs are documented in the risk matrix “Oracle REST Data Services Risk Matrix”

Additional CVEs addressed are:

The patch for CVE-2019-12900 also addresses CVE-2016-3189
The patch for CVE-2020-11023 also addresses CVE-2019-11358 and CVE-2020-11022
The patch for CVE-2020-13935 also addresses CVE-2020-11996, CVE-2020-13934 and CVE-2020-9484
The patch for CVE-2020-14734 also addresses CVE-2016-10244, CVE-2016-10328, CVE-2016-5300, CVE-2016-6153, CVE-2017-10989, CVE-2017-13685, CVE-2017-13745, CVE-2017-14232, CVE-2017-15286, CVE-2017-7857, CVE-2017-7858, CVE-2017-7864, CVE-2017-8105, CVE-2017-8287, CVE-2018-18873, CVE-2018-19139, CVE-2018-19539, CVE-2018-19540, CVE-2018-19541, CVE-2018-19542, CVE-2018-19543, CVE-2018-20346, CVE-2018-20505, CVE-2018-20506, CVE-2018-20570, CVE-2018-20584, CVE-2018-20622, CVE-2018-20843, CVE-2018-6942, CVE-2018-8740, CVE-2018-9055, CVE-2018-9154, CVE-2018-9252, CVE-2019-15903, CVE-2019-16168, CVE-2019-5018, CVE-2019-8457, CVE-2019-9936 and CVE-2019-9937

Additional patches are included in this Critical Patch Update for the following non-exploitable CVEs in this Oracle product family:

Core RDBMS (LZ4): CVE-2019-17543
Core RDBMS (Zstandard): CVE-2019-11922
Oracle Database (Perl Expat): CVE-2018-20843 and CVE-2019-15903
Oracle Spatial and Graph (Apache Log4j): CVE-2020-9488
Oracle Spatial and Graph (jackson-databind): CVE-2019-16943, CVE-2017-15095, CVE-2017-17485, CVE-2017-7525, CVE-2018-5968, CVE-2018-7489, CVE-2019-16942 and CVE-2019-17531
Oracle Spatial and Graph MapViewer (jQuery): CVE-2020-11023, CVE-2019-11358 and CVE-2020-11022
SQL Developer (Apache Batik): CVE-2018-8013 and CVE-2017-5662
SQL Developer (Apache Log4j): CVE-2017-5645
SQL Developer (Apache POI): CVE-2017-12626, CVE-2016-5000, CVE-2017-5644 and CVE-2019-12415
SQL Developer (jackson-databind): CVE-2018-7489, CVE-2017-15095, CVE-2017-17485, CVE-2018-1000873, CVE-2018-11307, CVE-2018-12022, CVE-2018-5968, CVE-2019-12086, CVE-2019-12384, CVE-2019-12814, CVE-2019-16335, CVE-2019-20330 and CVE-2020-8840
SQL Developer (JCraft JSch): CVE-2016-5725
SQL Developer Install (Bouncy Castle): CVE-2019-17359, CVE-2016-1000338, CVE-2016-1000339, CVE-2016-1000340, CVE-2016-1000341, CVE-2016-1000342, CVE-2016-1000343, CVE-2016-1000344, CVE-2016-1000345, CVE-2016-1000346, CVE-2016-1000352, CVE-2017-13098, CVE-2018-1000180, CVE-2018-1000613 and CVE-2018-5382

Oracle Database Server Client-Only Installations

The following Oracle Database Server vulnerability included in this Critical Patch Update affects client-only installations: CVE-2020-14740.

Oracle Big Data Graph Risk Matrix

This Critical Patch Update contains 1 new security patch plus additional third party patches noted below for Oracle Big Data Graph. This vulnerability is remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2019-0192	Big Data Spatial and Graph	Property Graph Analytics (Apache Solr)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	Prior to 3.0

Additional CVEs addressed are:

The patch for CVE-2019-0192 also addresses CVE-2017-3164

Additional patches are included in this Critical Patch Update for the following non-exploitable CVEs in this Oracle product family:

Big Data Spatial and Graph
- Property Graph Analytics (jQuery): CVE-2015-9251
- Property Graph Analytics (jackson-databind): CVE-2020-9546, CVE-2015-9251, CVE-2017-5645, CVE-2018-12023, CVE-2018-14718, CVE-2018-7489, CVE-2019-10744, CVE-2019-12086, CVE-2019-14379, CVE-2019-16943, CVE-2020-10650, CVE-2020-10672, CVE-2020-10673, CVE-2020-10968, CVE-2020-10969, CVE-2020-11111, CVE-2020-11112, CVE-2020-11113, CVE-2020-11619, CVE-2020-11620, CVE-2020-14195, CVE-2020-9547 and CVE-2020-9548
- Property Graph Analytics (lodash): CVE-2019-10744
- Property Graph Analytics (Apache Log4j): CVE-2017-5645

Oracle REST Data Services Risk Matrix

This Critical Patch Update contains 5 new security patches plus additional third party patches noted below for Oracle REST Data Services. 2 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2017-7658	Oracle REST Data Services	General (Eclipse Jetty)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	11.2.0.4, 12.1.0.2, 12.2.0.1, 18c
CVE-2016-1000031	Oracle REST Data Services	General (Apache Commons FileUpload)	HTTP	No	8.0	Network	Low	Low	Required	Un- changed	High	High	High	11.2.0.4, 12.1.0.2, 12.2.0.1, 18c
CVE-2020-14744	Oracle REST Data Services	General	HTTP	No	6.5	Network	Low	Low	None	Un- changed	High	None	None	11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, 19c; Standalone ORDS: prior to 20.2.1
CVE-2020-11023	Oracle REST Data Services	General (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, 19c; Standalone ORDS: prior to 20.2.1
CVE-2020-14745	Oracle REST Data Services	General	HTTP	No	4.3	Network	Low	Low	None	Un- changed	Low	None	None	11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, 19c; Standalone ORDS: prior to 20.2.1

Additional CVEs addressed are:

The patch for CVE-2017-7658 also addresses CVE-2016-4800, CVE-2017-7656, CVE-2017-7657, CVE-2017-9735, CVE-2018-12536, CVE-2018-12538, CVE-2018-12545, CVE-2019-10241, CVE-2019-10246, CVE-2019-10247 and CVE-2019-17632
The patch for CVE-2020-11023 also addresses CVE-2019-11358 and CVE-2020-11022

Additional patches are included in this Critical Patch Update for the following non-exploitable CVEs in this Oracle product family:

Oracle REST Data Services
- General (Apache Batik): CVE-2018-8013 and CVE-2017-5662
- General (jackson-databind): CVE-2019-16335, CVE-2019-12814, CVE-2019-14540, CVE-2019-14893, CVE-2019-17531, CVE-2019-20330, CVE-2020-11113, CVE-2020-11620 and CVE-2020-8840

Oracle TimesTen In-Memory Database Risk Matrix

This Critical Patch Update contains 4 new security patches for Oracle TimesTen In-Memory Database. All of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2018-11058	Oracle TimesTen In-Memory Database	EM TimesTen plugin (RSA BSAFE Crypto-C)	Multiple	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	Prior to 18.1.4.1.0
CVE-2017-5645	Oracle TimesTen In-Memory Database	Install (Apache Log4j)	Multiple	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	Prior to 11.2.2.8.49
CVE-2019-1010239	Oracle TimesTen In-Memory Database	Install (Dave Gamble/cJSON)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	Prior to 18.1.3.1.0
CVE-2019-0201	Oracle TimesTen In-Memory Database	Install (Apache ZooKeeper)	ZAB	Yes	5.9	Network	High	None	None	Un- changed	High	None	None	Prior to 18.1.3.1.0

Additional CVEs addressed are:

The patch for CVE-2017-5645 also addresses CVE-2020-1945
The patch for CVE-2018-11058 also addresses CVE-2016-0701, CVE-2016-2183, CVE-2016-6306, CVE-2016-8610, CVE-2018-11054, CVE-2018-11055, CVE-2018-11056, CVE-2018-11057 and CVE-2018-15769
The patch for CVE-2019-1010239 also addresses CVE-2019-11834 and CVE-2019-11835

Oracle Communications Applications Risk Matrix

This Critical Patch Update contains 9 new security patches for Oracle Communications Applications. 8 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2019-10173	Oracle Communications BRM – Elastic Charging Engine	Diameter Gateway and SDK (xstream)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	11.3.0.9.0, 12.0.0.3.0
CVE-2020-10683	Oracle Communications Unified Inventory Management	Core (dom4j)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	7.3.0, 7.4.0
CVE-2019-10173	Oracle Communications Unified Inventory Management	Core (xstream)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	7.3.0, 7.4.0
CVE-2020-10878	Oracle Communications Billing and Revenue Management	Core (Perl)	TCP	Yes	8.6	Network	Low	None	None	Un- changed	Low	Low	High	12.0.0.2.0, 12.0.0.3.0
CVE-2020-11022	Oracle Communications Billing and Revenue Management	Billing Operation Center and Oracle Communication Billing Care (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	7.5.0.23.0, 12.0.0.3.0
CVE-2020-9489	Oracle Communications Messaging Server	Core (Apache Tika)	None	No	5.5	Local	Low	None	Required	Un- changed	None	None	High	8.1
CVE-2020-9488	Oracle Communications Billing and Revenue Management	Billing Operation Center and Oracle Communication Billing Care (Apache Log4j)	SMTPS	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	7.5.0.23.0, 12.0.0.3.0
CVE-2020-9488	Oracle Communications Offline Mediation Controller	Core (Apache Log4j)	SMTPS	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	12.0.0.3.0
CVE-2020-9488	Oracle Communications Unified Inventory Management	Core (Apache Log4j)	SMTPS	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	7.3.0, 7.4.0

Additional CVEs addressed are:

The patch for CVE-2020-10878 also addresses CVE-2020-10543 and CVE-2020-12723
The patch for CVE-2020-11022 also addresses CVE-2020-11023

Oracle Communications Risk Matrix

This Critical Patch Update contains 52 new security patches for Oracle Communications. 41 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-10683	Oracle Communications Application Session Controller	WS and WEB (dom4j)	Multiple	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	3.9m0p1
CVE-2020-11973	Oracle Communications Diameter Signaling Router (DSR)	IDIH (Apache Camel)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	IDIH: 8.0.0-8.2.2
CVE-2020-2555	Oracle Communications Diameter Signaling Router (DSR)	IDIH (Oracle Coherence)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	IDIH: 8.0.0-8.2.2
CVE-2020-10683	Oracle Communications Diameter Signaling Router (DSR)	IDIH (dom4j)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	IDIH: 8.0.0-8.2.2
CVE-2019-2904	Oracle Communications Diameter Signaling Router (DSR)	Platform (Application Development Framework)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	8.0.0.0-8.4.0.5
CVE-2019-12260	Oracle Communications EAGLE Software	Network Stack (Wind River VxWorks)	TCP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	46.6.0-46.8.2
CVE-2020-11984	Oracle Communications Element Manager	Core (Apache HTTP Server)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	8.2.0-8.2.2
CVE-2020-11984	Oracle Communications Session Report Manager	Core (Apache HTTP Server)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	8.2.0-8.2.2
CVE-2020-11984	Oracle Communications Session Route Manager	Core (Apache HTTP Server)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	8.2.0-8.2.2
CVE-2019-13990	Oracle Communications Session Route Manager	Core (Quartz Scheduler)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	8.2.0-8.2.2
CVE-2019-17638	Oracle Communications Application Session Controller	WS and WEB (Eclipse Jetty)	HTTP	Yes	9.4	Network	Low	None	None	Un- changed	High	High	Low	3.9m0p1
CVE-2019-17638	Oracle Communications Element Manager	Core (Eclipse Jetty)	HTTP	Yes	9.4	Network	Low	None	None	Un- changed	High	High	Low	8.2.0-8.2.2
CVE-2019-17638	Oracle Communications Session Report Manager	Core (Eclipse Jetty)	HTTP	Yes	9.4	Network	Low	None	None	Un- changed	High	High	Low	8.2.0-8.2.2
CVE-2019-17638	Oracle Communications Session Route Manager	Core (Eclipse Jetty)	HTTP	Yes	9.4	Network	Low	None	None	Un- changed	High	High	Low	8.2.0-8.2.2
CVE-2020-14195	Oracle Communications Diameter Signaling Router (DSR)	IDIH (jackson-databind)	HTTP	Yes	8.1	Network	High	None	None	Un- changed	High	High	High	IDIH: 8.0.0-8.2.2
CVE-2020-14195	Oracle Communications Element Manager	Core (jackson-databind)	HTTP	Yes	8.1	Network	High	None	None	Un- changed	High	High	High	8.2.0-8.2.2
CVE-2020-14195	Oracle Communications Evolved Communications Application Server	Universal Data Record (jackson-databind)	XCAP	Yes	8.1	Network	High	None	None	Un- changed	High	High	High	7.1
CVE-2020-14195	Oracle Communications Session Report Manager	Core (jackson-databind)	HTTP	Yes	8.1	Network	High	None	None	Un- changed	High	High	High	8.2.0-8.2.2
CVE-2020-14195	Oracle Communications Session Route Manager	Core (jackson-databind)	HTTP	Yes	8.1	Network	High	None	None	Un- changed	High	High	High	8.2.0-8.2.2
CVE-2020-5398	Oracle Communications Diameter Signaling Router (DSR)	IDIH (Spring Framework)	HTTP	Yes	7.5	Network	High	None	Required	Un- changed	High	High	High	IDIH: 8.0.0-8.2.2
CVE-2019-17359	Oracle Communications Diameter Signaling Router (DSR)	IDIH (Bouncy Castle Java Library)	HTTPS	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	IDIH: 8.0.0-8.2.2
CVE-2019-12402	Oracle Communications Element Manager	Core (Apache Commons Compress)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	8.2.0-8.2.2
CVE-2020-11080	Oracle Communications Session Border Controller	System (http2)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	8.3, 8.4
CVE-2019-12402	Oracle Communications Session Report Manager	Core (Apache Commons Compress)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	8.2.0-8.2.2
CVE-2019-12402	Oracle Communications Session Route Manager	Core (Apache Commons Compress)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	8.2.0-8.2.2
CVE-2019-17359	Oracle Communications Session Route Manager	Core (Bouncy Castle Java Library)	HTTPS	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	8.2.0-8.2.2
CVE-2019-10173	Oracle Communications Diameter Signaling Router (DSR)	IDIH (xstream)	HTTP	Yes	7.3	Network	Low	None	None	Un- changed	Low	Low	Low	IDIH: 8.0.0-8.2.2
CVE-2020-9484	Oracle Communications Diameter Signaling Router (DSR)	Core (Apache Tomcat)	None	No	7.0	Local	High	Low	None	Un- changed	High	High	High	8.0.0.0-8.4.0.5
CVE-2020-9484	Oracle Communications Element Manager	Core (Apache Tomcat)	None	No	7.0	Local	High	Low	None	Un- changed	High	High	High	8.2.0-8.2.2
CVE-2020-9484	Oracle Communications Session Report Manager	Core (Apache Tomcat)	None	No	7.0	Local	High	Low	None	Un- changed	High	High	High	8.2.0-8.2.2
CVE-2020-9484	Oracle Communications Session Route Manager	Core (Apache Tomcat)	None	No	7.0	Local	High	Low	None	Un- changed	High	High	High	8.2.0-8.2.2
CVE-2020-1945	Oracle Communications Diameter Signaling Router (DSR)	IDIH (Apache Ant)	None	No	6.7	Local	High	None	None	Un- changed	High	High	None	IDIH: 8.0.0-8.2.2
CVE-2020-10722	Oracle Communications Session Border Controller	Platform (DPDK)	None	No	6.7	Local	Low	High	None	Un- changed	High	High	High	8.2-8.4
CVE-2020-5408	Oracle Communications Element Manager	Core (Spring Security)	HTTP	No	6.5	Network	Low	Low	None	Un- changed	High	None	None	8.2.0-8.2.2
CVE-2020-5408	Oracle Communications Session Report Manager	Core (Spring Security)	HTTP	No	6.5	Network	Low	Low	None	Un- changed	High	None	None	8.2.0-8.2.2
CVE-2020-5408	Oracle Communications Session Route Manager	Core (Spring Security)	HTTP	No	6.5	Network	Low	Low	None	Un- changed	High	None	None	8.2.0-8.2.2
CVE-2020-11022	Oracle Communications Application Session Controller	Core (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	3.8m0
CVE-2020-1941	Oracle Communications Diameter Signaling Router (DSR)	IDIH (Apache ActiveMQ)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	IDIH: 8.0.0-8.2.2
CVE-2020-11022	Oracle Communications Diameter Signaling Router (DSR)	IDIH (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	IDIH: 8.0.0-8.2.2
CVE-2019-17091	Oracle Communications Diameter Signaling Router (DSR)	Platform (Eclipse Mojarra)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.0.0.0-8.4.0.5
CVE-2020-14788	Oracle Communications Diameter Signaling Router (DSR)	User Interface	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.0.0.0-8.4.0.5
CVE-2020-11022	Oracle Communications WebRTC Session Controller	ME (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	7.2
CVE-2020-11022	Oracle Enterprise Session Border Controller	Core (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.4
CVE-2019-12415	Oracle Communications Diameter Signaling Router (DSR)	IDIH (Apache POI)	None	No	5.5	Local	Low	Low	None	Un- changed	High	None	None	IDIH: 8.0.0-8.2.2
CVE-2020-14787	Oracle Communications Diameter Signaling Router (DSR)	User Interface	HTTP	No	5.4	Network	Low	Low	Required	Changed	Low	Low	None	8.0.0.0-8.4.0.5
CVE-2019-11048	Oracle Communications Diameter Signaling Router (DSR)	Core (PHP)	HTTP	Yes	5.3	Network	Low	None	None	Un- changed	None	None	Low	8.0.0.0-8.4.0.5
CVE-2020-1954	Oracle Communications Diameter Signaling Router (DSR)	IDIH (Apache CXF)	HTTP	Yes	5.3	Adjacent Network	High	None	None	Un- changed	High	None	None	IDIH: 8.0.0-8.2.2
CVE-2020-1954	Oracle Communications Element Manager	Core (Apache CXF)	HTTP	Yes	5.3	Adjacent Network	High	None	None	Un- changed	High	None	None	8.2.0-8.2.2
CVE-2020-1954	Oracle Communications Session Report Manager	Core (Apache CXF)	HTTP	Yes	5.3	Adjacent Network	High	None	None	Un- changed	High	None	None	8.2.0-8.2.2
CVE-2020-1954	Oracle Communications Session Route Manager	Core (Apache CXF)	HTTP	Yes	5.3	Adjacent Network	High	None	None	Un- changed	High	None	None	8.2.0-8.2.2
CVE-2020-9488	Oracle Communications Application Session Controller	WS and WEB (Apache Log4j)	SMTPS	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	3.9m0p1
CVE-2020-9488	Oracle Communications Services Gatekeeper	Media Control UI (Apache Log4j)	SMTPS	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	7

Additional CVEs addressed are:

The patch for CVE-2019-11048 also addresses CVE-2020-7067
The patch for CVE-2019-12260 also addresses CVE-2019-12261
The patch for CVE-2019-13990 also addresses CVE-2019-5427
The patch for CVE-2019-17638 also addresses CVE-2019-17632
The patch for CVE-2020-10722 also addresses CVE-2020-10723 and CVE-2020-10724
The patch for CVE-2020-11022 also addresses CVE-2020-11023
The patch for CVE-2020-11080 also addresses CVE-2019-5436, CVE-2019-5481, CVE-2019-5482, CVE-2019-9511 and CVE-2019-9513
The patch for CVE-2020-11973 also addresses CVE-2020-11971 and CVE-2020-11972
The patch for CVE-2020-11984 also addresses CVE-2020-11993 and CVE-2020-9490
The patch for CVE-2020-14195 also addresses CVE-2020-10650, CVE-2020-10672, CVE-2020-10673, CVE-2020-10968, CVE-2020-10969, CVE-2020-11111, CVE-2020-11112, CVE-2020-11113, CVE-2020-14060, CVE-2020-14061, CVE-2020-14062, CVE-2020-9546, CVE-2020-9547 and CVE-2020-9548
The patch for CVE-2020-1941 also addresses CVE-2020-13920
The patch for CVE-2020-1945 also addresses CVE-2017-5645
The patch for CVE-2020-1954 also addresses CVE-2019-12423
The patch for CVE-2020-5398 also addresses CVE-2020-5397
The patch for CVE-2020-5408 also addresses CVE-2020-5407

Oracle Construction and Engineering Risk Matrix

This Critical Patch Update contains 9 new security patches for Oracle Construction and Engineering. 7 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-11984	Instantis EnterpriseTrack	Core (Apache HTTP Server)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	17.1, 17.2, 17.3
CVE-2019-17495	Primavera Gateway	Admin (Swagger UI)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	16.2.0-16.2.11, 17.12.0-17.12.8
CVE-2015-1832	Primavera Unifier	Platform (Apache Derby)	HTTP	Yes	9.1	Network	Low	None	None	Un- changed	High	None	High	16.1, 16.2, 17.7-17.12, 18.8, 19.12
CVE-2017-9096	Primavera Unifier	Platform (iText)	HTTP	Yes	8.8	Network	Low	None	Required	Un- changed	High	High	High	16.1, 16.2, 17.7-17.12, 18.8, 19.12
CVE-2020-13935	Instantis EnterpriseTrack	Core (Apache Tomcat)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	17.1, 17.2, 17.3
CVE-2019-17558	Primavera Unifier	Platform (Apache Solr)	HTTP	No	7.5	Network	High	Low	None	Un- changed	High	High	High	16.1, 16.2, 17.7-17.12, 18.8, 19.12
CVE-2018-17196	Primavera Unifier	Core (Apache Kafka)	HTTP	Yes	7.0	Network	High	None	None	Un- changed	High	Low	Low	18.8, 19.12
CVE-2020-9489	Primavera Unifier	Platform (Apache Tika)	None	No	5.5	Local	Low	None	Required	Un- changed	None	None	High	16.1, 16.2, 17.7-17.12, 18.8, 19.12
CVE-2020-9488	Primavera Unifier	Core (Apache Log4j)	SMTPS	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	18.8, 19.12

Additional CVEs addressed are:

The patch for CVE-2020-11984 also addresses CVE-2020-11993 and CVE-2020-9490
The patch for CVE-2020-13935 also addresses CVE-2020-13934

Oracle E-Business Suite Risk Matrix

This Critical Patch Update contains 27 new security patches for Oracle E-Business Suite. 25 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

Oracle E-Business Suite products include Oracle Database and Oracle Fusion Middleware components that are affected by the vulnerabilities listed in the Oracle Database and Oracle Fusion Middleware sections. The exposure of Oracle E-Business Suite products is dependent on the Oracle Database and Oracle Fusion Middleware versions being used. Oracle Database and Oracle Fusion Middleware security updates are not listed in the Oracle E-Business Suite risk matrix. However, since vulnerabilities affecting Oracle Database and Oracle Fusion Middleware versions may affect Oracle E-Business Suite products, Oracle recommends that customers apply the October 2020 Critical Patch Update to the Oracle Database and Oracle Fusion Middleware components of Oracle E-Business Suite. For information on what patches need to be applied to your environments, refer to Oracle E-Business Suite Release 12 Critical Patch Update Knowledge Document (October 2020), My Oracle Support Note 2707309.1.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-14855	Oracle Universal Work Queue	Work Provider Administration	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.1.3
CVE-2020-14805	Oracle E-Business Suite Secure Enterprise Search	Search Integration Engine	HTTP	Yes	9.1	Network	Low	None	None	Un- changed	High	High	None	12.1.3, 12.2.3 – 12.2.10
CVE-2020-14875	Oracle Marketing	Marketing Administration	HTTP	Yes	9.1	Network	Low	None	None	Un- changed	High	High	None	12.1.1 – 12.1.3, 12.2.3 – 12.2.10
CVE-2020-14876	Oracle Trade Management	User Interface	HTTP	Yes	9.1	Network	Low	None	None	Un- changed	High	High	None	12.1.1 – 12.1.3, 12.2.3 – 12.2.10
CVE-2020-14862	Oracle Universal Work Queue	Internal Operations	HTTP	No	8.8	Network	Low	Low	None	Un- changed	High	High	High	12.2.3 – 12.2.9
CVE-2020-14850	Oracle CRM Technical Foundation	Flex Fields	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.3, 12.2.3 – 12.2.10
CVE-2020-14816	Oracle Marketing	Marketing Administration	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1 – 12.1.3, 12.2.3 – 12.2.10
CVE-2020-14817	Oracle Marketing	Marketing Administration	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1 – 12.1.3, 12.2.3 – 12.2.10
CVE-2020-14831	Oracle Marketing	Marketing Administration	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1 – 12.1.3, 12.2.3 – 12.2.10
CVE-2020-14835	Oracle Marketing	Marketing Administration	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1 – 12.1.3
CVE-2020-14849	Oracle Marketing	Marketing Administration	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1 – 12.1.3, 12.2.3 – 12.2.10
CVE-2020-14819	Oracle One-to-One Fulfillment	Print Server	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.3
CVE-2020-14863	Oracle One-to-One Fulfillment	Print Server	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1 – 12.1.3
CVE-2020-14808	Oracle Trade Management	User Interface	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.3, 12.2.3 – 12.2.10
CVE-2020-14833	Oracle Trade Management	User Interface	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1 – 12.1.3, 12.2.3 – 12.2.10
CVE-2020-14834	Oracle Trade Management	User Interface	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1 – 12.1.3, 12.2.3 – 12.2.10
CVE-2020-14851	Oracle Trade Management	User Interface	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1 – 12.1.3, 12.2.3 – 12.2.10
CVE-2020-14856	Oracle Trade Management	User Interface	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1 – 12.1.3, 12.2.3 – 12.2.10
CVE-2020-14857	Oracle Trade Management	User Interface	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	12.1.1 – 12.1.3, 12.2.3 – 12.2.10
CVE-2020-14774	Oracle CRM Technical Foundation	Preferences	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	12.1.1 – 12.1.3, 12.2.3 – 12.2.10
CVE-2020-14761	Oracle Applications Manager	Oracle Diagnostics Interfaces	HTTP	Yes	6.5	Network	Low	None	None	Un- changed	Low	Low	None	12.1.3, 12.2.3 – 12.2.7
CVE-2020-14823	Oracle CRM Technical Foundation	Preferences	HTTP	No	6.5	Network	Low	High	None	Un- changed	High	High	None	12.2.3 – 12.2.10
CVE-2020-14811	Oracle Applications Manager	AMP EBS Integration	HTTP	Yes	5.3	Network	Low	None	None	Un- changed	Low	None	None	12.1.3, 12.2.3 – 12.2.10
CVE-2020-14826	Oracle Applications Manager	SQL Extensions	HTTP	Yes	5.3	Network	Low	None	None	Un- changed	Low	None	None	12.1.3, 12.2.3 – 12.2.10
CVE-2020-14840	Oracle Application Object Library	Diagnostics	HTTP	Yes	4.7	Network	Low	None	Required	Changed	None	Low	None	12.1.3, 12.2.3 – 12.2.10
CVE-2020-14746	Oracle Applications Framework	Popup windows	HTTP	Yes	4.7	Network	Low	None	Required	Changed	None	Low	None	12.1.3, 12.2.3 – 12.2.10
CVE-2020-14822	Oracle Installed Base	APIs	HTTP	Yes	4.7	Network	Low	None	Required	Changed	None	Low	None	12.1.1 – 12.1.3, 12.2.3 – 12.2.10

Oracle Enterprise Manager Risk Matrix

This Critical Patch Update contains 11 new security patches for Oracle Enterprise Manager. 10 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. None of these patches are applicable to client-only installations, i.e., installations that do not have Oracle Enterprise Manager installed. The English text form of this Risk Matrix can be found here.

Oracle Enterprise Manager products include Oracle Database and Oracle Fusion Middleware components that are affected by the vulnerabilities listed in the Oracle Database and Oracle Fusion Middleware sections. The exposure of Oracle Enterprise Manager products is dependent on the Oracle Database and Oracle Fusion Middleware versions being used. Oracle Database and Oracle Fusion Middleware security updates are not listed in the Oracle Enterprise Manager risk matrix. However, since vulnerabilities affecting Oracle Database and Oracle Fusion Middleware versions may affect Oracle Enterprise Manager products, Oracle recommends that customers apply the October 2020 Critical Patch Update to the Oracle Database and Oracle Fusion Middleware components of Enterprise Manager. For information on what patches need to be applied to your environments, refer to Critical Patch Update October 2020 Patch Availability Document for Oracle Products, My Oracle Support Note 2694898.1.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2019-13990	Enterprise Manager Ops Center	Agent Provisioning (Quartz Scheduler)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.4.0.0
CVE-2018-11058	Oracle Application Testing Suite	Load Testing for Web Apps (RSA BSAFE Crypto-C)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	13.3.0.1
CVE-2019-17638	Oracle Application Testing Suite	Load Testing for Web Apps (Eclipse Jetty)	HTTP	Yes	9.4	Network	Low	None	None	Un- changed	High	High	Low	13.3.0.1
CVE-2020-5398	Enterprise Manager Base Platform	Connector Framework (Spring Framework)	HTTP	Yes	7.5	Network	High	None	Required	Un- changed	High	High	High	13.2.1.0
CVE-2020-1967	Enterprise Manager for Storage Management	Privilege Management (OpenSSL)	HTTPS	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	13.3.0.0, 13.4.0.0
CVE-2020-5398	Oracle Application Testing Suite	Load Testing for Web Apps (Spring Framework)	HTTP	Yes	7.5	Network	High	None	Required	Un- changed	High	High	High	13.3.0.1
CVE-2019-3740	Application Performance Management (APM)	Comp Management and Life Cycle Management (RSA BSAFE Crypto-J)	HTTPS	Yes	6.5	Network	Low	None	Required	Un- changed	High	None	None	13.3.0.0, 13.4.0.0
CVE-2019-2897	Enterprise Manager Base Platform	Event Management	HTTP	No	6.4	Network	Low	Low	None	Changed	Low	Low	None	13.3.0.0, 13.4.0.0
CVE-2020-11022	Enterprise Manager Ops Center	Reports in Ops Center (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	12.4.0.0
CVE-2020-1954	Enterprise Manager Base Platform	Connector Framework (Apache CXF)	HTTP	Yes	5.3	Adjacent Network	High	None	None	Un- changed	High	None	None	13.2.1.0
CVE-2020-9488	Enterprise Manager for Peoplesoft	PSEM Plugin (Apache Log4j)	SMTPS	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	13.4.1.1

Additional CVEs addressed are:

The patch for CVE-2018-11058 also addresses CVE-2016-0701, CVE-2016-2183, CVE-2016-6306, CVE-2016-8610, CVE-2018-11054, CVE-2018-11055, CVE-2018-11056, CVE-2018-11057 and CVE-2018-15769
The patch for CVE-2019-13990 also addresses CVE-2019-5427
The patch for CVE-2019-17638 also addresses CVE-2019-17632
The patch for CVE-2019-3740 also addresses CVE-2019-3738 and CVE-2019-3739
The patch for CVE-2020-1954 also addresses CVE-2019-12419
The patch for CVE-2020-5398 also addresses CVE-2020-5397

Oracle Financial Services Applications Risk Matrix

This Critical Patch Update contains 53 new security patches for Oracle Financial Services Applications. 49 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2019-17495	Oracle Banking Platform	Collections (Swagger UI)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	2.4.0-2.10.0
CVE-2020-10683	Oracle Banking Platform	Collections (dom4j)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	2.4.0-2.10.0
CVE-2019-10173	Oracle Banking Platform	Collections (xstream)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	2.4.0-2.10.0
CVE-2020-10683	Oracle Financial Services Analytical Applications Infrastructure	Infrastructure (dom4j)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	8.0.6-8.1.0
CVE-2020-9546	Oracle Financial Services Analytical Applications Infrastructure	Infrastructure (jackson-databind)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	8.0.6-8.1.0
CVE-2020-9546	Oracle Financial Services Institutional Performance Analytics	User Interface (jackson-databind)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	8.0.6, 8.7.0, 8.1.0
CVE-2020-9546	Oracle Financial Services Price Creation and Discovery	User Interface (jackson-databind)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	8.0.6, 8.0.7
CVE-2017-5645	Oracle Financial Services Regulatory Reporting with AgileREPORTER	Core (Apache Ant)	Multiple	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	8.0.9.2.0
CVE-2020-9546	Oracle Financial Services Retail Customer Analytics	User Interface (jackson-databind)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	8.0.6
CVE-2020-11973	Oracle FLEXCUBE Private Banking	Core (Apache Camel)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.0.0, 12.1.0
CVE-2020-14824	Oracle Financial Services Analytical Applications Infrastructure	Infrastructure	HTTP	Yes	8.6	Network	Low	None	None	Changed	None	None	High	8.0.6-8.1.0
CVE-2020-14195	Oracle Banking Digital Experience	Framework (jackson-databind)	HTTPS	Yes	8.1	Network	High	None	None	Un- changed	High	High	High	18.1, 18.2, 18.3, 19.1, 19.2, 20.1
CVE-2020-5398	Oracle Financial Services Regulatory Reporting with AgileREPORTER	Core (Spring Framework)	HTTP	Yes	7.5	Network	High	None	Required	Un- changed	High	High	High	8.0.9.2.0
CVE-2020-5398	Oracle FLEXCUBE Private Banking	Core (Spring Framework)	HTTP	Yes	7.5	Network	High	None	Required	Un- changed	High	High	High	12.0.0, 12.1.0
CVE-2020-14894	Oracle Banking Corporate Lending	Core	HTTP	No	6.5	Network	Low	Low	None	Un- changed	High	None	None	12.3.0, 14.0.0-14.4.0
CVE-2020-14896	Oracle Banking Payments	Core	HTTP	No	6.5	Network	Low	Low	None	Un- changed	High	None	None	14.1.0-14.4.0
CVE-2020-14890	Oracle FLEXCUBE Direct Banking	Pre Login	HTTP	Yes	6.5	Network	Low	None	Required	Un- changed	High	None	None	12.0.1, 12.0.2, 12.0.3
CVE-2020-14897	Oracle FLEXCUBE Direct Banking	Pre Login	HTTP	Yes	6.5	Network	Low	None	Required	Un- changed	High	None	None	12.0.1, 12.0.2, 12.0.3
CVE-2020-14887	Oracle FLEXCUBE Universal Banking	Infrastructure	HTTP	No	6.5	Network	Low	Low	None	Un- changed	High	None	None	12.3.0, 14.0.0-14.4.0
CVE-2020-11022	Oracle Banking Digital Experience	Framework (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	18.1, 18.2, 18.3, 19.1, 19.2, 20.1
CVE-2020-11022	Oracle Financial Services Analytical Applications Infrastructure	Infrastructure (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.0.6-8.1.0
CVE-2020-11022	Oracle Financial Services Analytical Applications Reconciliation Framework	User Interface (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.0.6-8.0.8, 8.1.0
CVE-2020-11022	Oracle Financial Services Asset Liability Management	User Interface (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.0.6, 8.0.7, 8.1.0
CVE-2020-11022	Oracle Financial Services Balance Sheet Planning	User Interface (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.0.8
CVE-2020-11022	Oracle Financial Services Basel Regulatory Capital Basic	User Interface (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.0.6-8.0.8, 8.1.0
CVE-2020-11022	Oracle Financial Services Basel Regulatory Capital Internal Ratings Based Approach	User Interface (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.0.6-8.0.8, 8.1.0
CVE-2020-11022	Oracle Financial Services Data Foundation	Infrastructure (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.0.6-8.1.0
CVE-2020-11022	Oracle Financial Services Data Governance for US Regulatory Reporting	User Interface (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.0.6-8.0.9
CVE-2020-11022	Oracle Financial Services Data Integration Hub	User Interface (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.0.6, 8.0.7, 8.1.0
CVE-2020-11022	Oracle Financial Services Funds Transfer Pricing	User Interface (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.0.6, 8.0.7, 8.1.0
CVE-2020-11022	Oracle Financial Services Hedge Management and IFRS Valuations	User Interface (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.0.6-8.0.8, 8.1.0
CVE-2020-11022	Oracle Financial Services Institutional Performance Analytics	User Interface (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.0.6, 8.0.7, 8.1.0
CVE-2020-11022	Oracle Financial Services Liquidity Risk Management	User Interface (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.0.6
CVE-2020-11022	Oracle Financial Services Liquidity Risk Measurement and Management	User Interface (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.0.7, 8.0.8, 8.1.0
CVE-2020-11022	Oracle Financial Services Loan Loss Forecasting and Provisioning	User Interface (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.0.6-8.0.8, 8.1.0
CVE-2020-11022	Oracle Financial Services Market Risk Measurement and Management	Infrastructure (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.0.6, 8.0.8
CVE-2020-11022	Oracle Financial Services Price Creation and Discovery	User Interface (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.0.6, 8.0.7
CVE-2020-11022	Oracle Financial Services Profitability Management	User Interface (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.0.6, 8.0.7, 8.1.0
CVE-2020-11022	Oracle Financial Services Regulatory Reporting for European Banking Authority	User Interface (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.0.6-8.1.0
CVE-2020-11022	Oracle Financial Services Regulatory Reporting for US Federal Reserve	User Interface (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.0.6-8.0.9
CVE-2020-1941	Oracle FLEXCUBE Private Banking	Core (Apache ActiveMQ)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	12.0.0, 12.1.0
CVE-2020-11022	Oracle Insurance Accounting Analyzer	IFRS17 (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.0.9
CVE-2020-11022	Oracle Insurance Allocation Manager for Enterprise Profitability	User Interface (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.0.8, 8.1.0
CVE-2020-11022	Oracle Insurance Data Foundation	Infrastructure (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.0.6-8.1.0
CVE-2020-1951	Oracle FLEXCUBE Private Banking	Core (Apache Tika)	None	No	5.5	Local	Low	None	Required	Un- changed	None	None	High	12.0.0, 12.1.0
CVE-2019-10247	Oracle FLEXCUBE Core Banking	Core (Eclipse Jetty)	HTTP	Yes	5.3	Network	Low	None	None	Un- changed	Low	None	None	5.2.0, 11.5.0-11.7.0
CVE-2020-9488	Oracle Financial Services Analytical Applications Infrastructure	Infrastructure (Apache Log4j)	SMTPS	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	8.0.6-8.1.0
CVE-2020-9488	Oracle Financial Services Institutional Performance Analytics	User Interface (Apache Log4j)	SMTPS	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	8.0.6, 8.7.0, 8.1.0
CVE-2020-9488	Oracle Financial Services Market Risk Measurement and Management	Infrastructure (Apache log4j)	SMTPS	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	8.0.6, 8.0.8, 8.1.0
CVE-2020-9488	Oracle Financial Services Price Creation and Discovery	User Interface (Apache Log4j)	SMTPS	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	8.0.6, 8.0.7
CVE-2020-9488	Oracle Financial Services Retail Customer Analytics	User Interface (Apache Log4j)	SMTPS	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	8.0.6
CVE-2020-9488	Oracle FLEXCUBE Core Banking	Core (Apache Log4j)	SMTPS	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	5.2.0, 11.5.0-11.7.0
CVE-2020-9488	Oracle FLEXCUBE Private Banking	Core (Apache Log4j)	SMTPS	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	12.0.0, 12.1.0

Additional CVEs addressed are:

The patch for CVE-2019-10173 also addresses CVE-2013-7285
The patch for CVE-2019-10247 also addresses CVE-2019-10246
The patch for CVE-2020-11022 also addresses CVE-2020-11023
The patch for CVE-2020-11973 also addresses CVE-2020-11971 and CVE-2020-11972
The patch for CVE-2020-14195 also addresses CVE-2020-14060, CVE-2020-14061 and CVE-2020-14062
The patch for CVE-2020-1941 also addresses CVE-2020-13920
The patch for CVE-2020-1951 also addresses CVE-2020-1950
The patch for CVE-2020-5398 also addresses CVE-2020-5397
The patch for CVE-2020-9546 also addresses CVE-2020-10650, CVE-2020-10672, CVE-2020-10673, CVE-2020-10968, CVE-2020-10969, CVE-2020-11111, CVE-2020-11112, CVE-2020-11113, CVE-2020-9547 and CVE-2020-9548

Oracle Food and Beverage Applications Risk Matrix

This Critical Patch Update contains 4 new security patches for Oracle Food and Beverage Applications. 3 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-11022	Oracle Hospitality Materials Control	Mobile Authorization (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	18.1
CVE-2020-11022	Oracle Hospitality Simphony	Simphony Apps (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	18.1, 18.2, 19.1.0-19.1.2
CVE-2020-14753	Oracle Hospitality Reporting and Analytics	Installation	None	No	5.9	Local	Low	Low	Required	Changed	High	None	None	9.1.0
CVE-2020-14783	Oracle Hospitality RES 3700	CAL	TCP	Yes	5.3	Network	Low	None	None	Un- changed	Low	None	None	5.7

Additional CVEs addressed are:

The patch for CVE-2020-11022 also addresses CVE-2020-11023

Oracle Fusion Middleware Risk Matrix

This Critical Patch Update contains 46 new security patches for Oracle Fusion Middleware. 36 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

Oracle Fusion Middleware products include Oracle Database components that are affected by the vulnerabilities listed in the Oracle Database section. The exposure of Oracle Fusion Middleware products is dependent on the Oracle Database version being used. Oracle Database security updates are not listed in the Oracle Fusion Middleware risk matrix. However, since vulnerabilities affecting Oracle Database versions may affect Oracle Fusion Middleware products, Oracle recommends that customers apply the Critical Patch Update October 2020 to the Oracle Database components of Oracle Fusion Middleware products. For information on what patches need to be applied to your environments, refer to Critical Patch Update October 2020 Patch Availability Document for Oracle Products, My Oracle Support Note 2694898.1.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2017-5645	Identity Manager Connector	General and Misc (Apache Log4j)	Multiple	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	9.0
CVE-2018-11058	Oracle Access Manager	Web Server Plugin (RSA BSafe)	HTTPS	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	11.1.2.3.0
CVE-2017-9800	Oracle Data Integrator	Install, config, upgrade (Apache HTTP Server)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.2.1.3.0
CVE-2020-10683	Oracle Endeca Information Discovery Integrator	Integrator ETL (dom4j)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	3.2.0
CVE-2019-10173	Oracle Endeca Information Discovery Studio	Endeca Server (xstream)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	3.2.0
CVE-2019-2904	Oracle Enterprise Repository	Security Subsystem – 12c (Application Development Framework)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	11.1.1.7.0
CVE-2018-8088	Oracle GoldenGate Application Adapters	Application Adapters (SLF4J)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.3.2.1.0
CVE-2019-17531	Oracle GoldenGate Application Adapters	Build Request (jackson-databind)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	19.1.0.0.0
CVE-2018-11058	Oracle GoldenGate Application Adapters	Security Service (RSA BSAFE)	HTTPS	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.3.2.1.0
CVE-2019-5482	Oracle HTTP Server	Web Listener (cURL)	TFTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.2.1.3.0, 12.2.1.4.0
CVE-2020-10683	Oracle WebCenter Portal	Portlet Services (dom4j)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.2.1.3.0, 12.2.1.4.0
CVE-2020-2555	Oracle WebCenter Portal	Security Framework (Oracle Coherence)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.2.1.3.0, 12.2.1.4.0
CVE-2019-10173	Oracle WebCenter Portal	Security Framework (xstream)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	11.1.1.9.0, 12.2.1.3.0
CVE-2019-17267	Oracle WebLogic Server	Centralized Thirdparty Jars (jackson-databind)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.2.1.3.0
CVE-2020-14882	Oracle WebLogic Server	Console	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
CVE-2020-14841	Oracle WebLogic Server	Core	IIOP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
CVE-2020-14825	Oracle WebLogic Server	Core	IIOP, T3	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
CVE-2020-14859	Oracle WebLogic Server	Core	IIOP, T3	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
CVE-2020-14879	BI Publisher	E-Business Suite – XDO	HTTP	No	8.5	Network	Low	Low	None	Changed	High	Low	None	5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2020-14880	BI Publisher	E-Business Suite – XDO	HTTP	No	8.5	Network	Low	Low	None	Changed	High	Low	None	5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2020-14842	BI Publisher	BI Publisher Security	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2020-14784	Oracle BI Publisher	Mobile Service	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2020-14815	Oracle Business Intelligence Enterprise Edition	Analytics Actions	HTTP	Yes	8.2	Network	Low	None	Required	Changed	High	Low	None	5.5.0.0.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2016-2510	Oracle Data Integrator	Jave APIs (BeanShell)	HTTP	Yes	8.1	Network	High	None	None	Un- changed	High	High	High	11.1.1.9.0, 12.2.1.3.0
CVE-2020-3235	Management Pack for Oracle GoldenGate	Monitor (SNMP)	SNMP	No	7.7	Network	Low	Low	None	Changed	None	None	High	12.2.1.2.0
CVE-2020-14864	Oracle Business Intelligence Enterprise Edition	Installation	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	High	None	None	5.5.0.0.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2020-1967	Oracle HTTP Server	SSL Module (OpenSSL)	HTTPS	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	12.2.1.4.0
CVE-2020-14820	Oracle WebLogic Server	Core	IIOP, T3	Yes	7.5	Network	Low	None	None	Un- changed	High	None	None	10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
CVE-2019-10097	Oracle HTTP Server	Core (Apache HTTP Server)	HTTP	No	7.2	Network	Low	High	None	Un- changed	High	High	High	12.2.1.4.0
CVE-2020-14883	Oracle WebLogic Server	Console	HTTP	No	7.2	Network	Low	High	None	Un- changed	High	High	High	10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
CVE-2020-14780	BI Publisher	BI Publisher Security	HTTP	Yes	7.1	Network	Low	None	Required	Un- changed	High	Low	None	5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2020-14843	Oracle Business Intelligence Enterprise Edition	Analytics Actions	HTTP	Yes	7.1	Network	Low	None	Required	Changed	Low	Low	Low	5.5.0.0.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2020-14766	Oracle Business Intelligence Enterprise Edition	Analytics Web Administration	HTTP	No	7.1	Network	Low	Low	None	Un- changed	High	Low	None	5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2020-9484	Oracle Managed File Transfer	MFT Runtime Server (Apache Tomcat)	None	No	7.0	Local	High	Low	None	Un- changed	High	High	High	12.2.1.3.0, 12.2.1.4.0
CVE-2020-14757	Oracle WebLogic Server	Web Services	HTTP	Yes	6.8	Network	High	None	Required	Un- changed	High	High	None	12.2.1.3.0
CVE-2020-15389	Oracle Outside In Technology	Installation (OpenJPEG)	HTTP	Yes	6.5	Network	High	None	None	Un- changed	Low	None	High	8.5.5, 8.5.4	See Note 1
CVE-2020-1945	Oracle Business Process Management Suite	Runtime Engine (Apache Ant)	None	No	6.3	Local	High	Low	None	Un- changed	High	High	None	12.2.1.3.0, 12.2.1.4.0
CVE-2019-11358	BI Publisher	BI Publisher Security (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	5.5.0.0.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2019-11358	Oracle Business Process Management Suite	Runtime Engine (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	12.2.1.3.0, 12.2.1.4.0
CVE-2019-2904	Oracle Business Process Management Suite	Runtime Engine (Application Development Framework)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	12.2.1.3.0, 12.2.1.4.0
CVE-2020-11022	Oracle JDeveloper	ADF Faces (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2020-9281	Oracle WebCenter Portal	Blogs and Wikis (CKEditor)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
CVE-2020-11022	Oracle WebLogic Server	Console (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
CVE-2020-1951	Oracle Business Process Management Suite	Document Service (Apache Tika)	None	No	5.5	Local	Low	None	Required	Un- changed	None	None	High	12.2.1.3.0, 12.2.1.4.0
CVE-2020-13631	Oracle Outside In Technology	Installation (SQLite)	None	No	5.5	Local	Low	Low	None	Un- changed	None	High	None	8.5.5, 8.5.4	See Note 1
CVE-2020-9488	Oracle WebLogic Server	Core (Apache Log4j)	SMTPS	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	10.3.6.0.0

Notes:

Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower.

Additional CVEs addressed are:

The patch for CVE-2017-9800 also addresses CVE-2016-2167, CVE-2016-2168 and CVE-2016-8734
The patch for CVE-2018-11058 also addresses CVE-2016-0701, CVE-2016-2183, CVE-2016-6306, CVE-2016-8610, CVE-2018-11054, CVE-2018-11055, CVE-2018-11056, CVE-2018-11057 and CVE-2018-15769
The patch for CVE-2019-17267 also addresses CVE-2019-14540, CVE-2019-16335, CVE-2019-16942 and CVE-2019-16943
The patch for CVE-2019-17531 also addresses CVE-2019-16943, CVE-2019-17267 and CVE-2019-20330
The patch for CVE-2019-5482 also addresses CVE-2019-5435, CVE-2019-5436, CVE-2019-5443 and CVE-2019-5481
The patch for CVE-2020-11022 also addresses CVE-2020-11023
The patch for CVE-2020-13631 also addresses CVE-2020-11655, CVE-2020-11656, CVE-2020-13630, CVE-2020-13632, CVE-2020-15358 and CVE-2020-9327
The patch for CVE-2020-1951 also addresses CVE-2020-1950

Oracle GraalVM Risk Matrix

This Critical Patch Update contains 1 new security patch for Oracle GraalVM. This vulnerability is remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-14803	Oracle GraalVM Enterprise Edition	Java	Multiple	Yes	5.3	Network	Low	None	None	Un- changed	Low	None	None	19.3.3, 20.2.0

Oracle Health Sciences Applications Risk Matrix

This Critical Patch Update contains 4 new security patches for Oracle Health Sciences Applications. All of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-1953	Oracle Healthcare Foundation	Self Service Analytics (Apache Commons Configuration)	HTTP	Yes	10.0	Network	Low	None	None	Changed	High	High	High	7.1.1, 7.2.0, 7.2.1, 7.3.0
CVE-2020-10683	Oracle Health Sciences Empirica Signal	User Interface (dom4j)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	9.0
CVE-2020-2555	Oracle Healthcare Data Repository	Database Module (Oracle Coherence)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	7.0.1
CVE-2020-11022	Oracle Healthcare Foundation	Admin Console (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	7.1.1, 7.2.0, 7.2.1, 7.3.0

Additional CVEs addressed are:

The patch for CVE-2020-11022 also addresses CVE-2020-11023

Oracle Hospitality Applications Risk Matrix

This Critical Patch Update contains 6 new security patches for Oracle Hospitality Applications. 3 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2019-17638	Oracle Hospitality Guest Access	Base (Eclipse Jetty)	HTTP	Yes	9.4	Network	Low	None	None	Un- changed	High	High	Low	4.2.0, 4.2.1
CVE-2020-14807	Oracle Hospitality Suite8	WebConnect	HTTP	Yes	7.1	Network	Low	None	Required	Un- changed	High	Low	None	8.10.2, 8.11-8.14
CVE-2020-9484	Oracle Hospitality Guest Access	Base (Apache Tomcat)	None	No	7.0	Local	High	Low	None	Un- changed	High	High	High	4.2.0, 4.2.1
CVE-2020-14858	Oracle Hospitality OPERA 5 Property Services	Logging	HTTP	No	6.8	Network	Low	High	Required	Un- changed	High	High	High	5.5, 5.6
CVE-2020-14877	Oracle Hospitality OPERA 5 Property Services	Logging	HTTP	No	6.5	Network	Low	High	None	Un- changed	High	High	None	5.5, 5.6
CVE-2020-14810	Oracle Hospitality Suite8	WebConnect	HTTP	Yes	5.4	Network	Low	None	Required	Un- changed	Low	Low	None	8.10.2, 8.11-8.14

Additional CVEs addressed are:

The patch for CVE-2019-17638 also addresses CVE-2019-17632

Oracle Hyperion Risk Matrix

This Critical Patch Update contains 9 new security patches for Oracle Hyperion. 1 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2019-5482	Hyperion Essbase	Security and Provisioning (cURL)	TFTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	11.1.2.4
CVE-2020-14854	Hyperion Infrastructure Technology	UI and Visualization	HTTP	No	6.1	Network	Low	High	Required	Un- changed	High	High	None	11.1.2.4
CVE-2019-1547	Hyperion Essbase	Security and Provisioning (OpenSSL)	None	No	4.7	Local	High	Low	None	Un- changed	High	None	None	11.1.2.4
CVE-2020-14768	Hyperion Analytic Provider Services	Smart View Provider	HTTP	No	4.3	Adjacent Network	High	Low	Required	Un- changed	Low	Low	Low	11.1.2.4
CVE-2020-14767	Hyperion BI+	IQR-Foundation service	Multiple	No	4.2	Network	High	High	Required	Un- changed	High	None	None	11.1.2.4
CVE-2020-14752	Hyperion Lifecycle Management	Shared Services	HTTP	No	4.2	Network	High	High	Required	Un- changed	None	High	None	11.1.2.4
CVE-2020-14772	Hyperion Lifecycle Management	Shared Services	HTTP	No	4.2	Network	High	High	Required	Un- changed	None	High	None	11.1.2.4
CVE-2020-14764	Hyperion Planning	Application Development Framework	HTTP	No	4.2	Network	High	High	Required	Un- changed	None	High	None	11.1.2.4
CVE-2020-14770	Hyperion BI+	IQR-Foundation service	Multiple	No	2.0	Network	High	High	Required	Un- changed	Low	None	None	11.1.2.4

Additional CVEs addressed are:

The patch for CVE-2019-1547 also addresses CVE-2019-1549, CVE-2019-1552 and CVE-2019-1563
The patch for CVE-2019-5482 also addresses CVE-2019-5481

Oracle Insurance Applications Risk Matrix

This Critical Patch Update contains 6 new security patches for Oracle Insurance Applications. All of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-9546	Oracle Insurance Policy Administration J2EE	Architecture (jackson-databind)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	11.0.2.25, 11.1.0.15
CVE-2020-5398	Oracle Insurance Policy Administration J2EE	Admin Console (Spring Framework)	HTTP	Yes	7.5	Network	High	None	Required	Un- changed	High	High	High	11.2.2.0
CVE-2020-11022	Oracle Insurance Insbridge Rating and Underwriting	Framework Administrator IBFA (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	5.0.0.0 – 5.6.0.0, 5.6.1.0
CVE-2020-9488	Oracle Insurance Insbridge Rating and Underwriting	Framework Administrator IBFA (Apache Log4j)	SMTPS	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	5.0.0.0 – 5.6.0.0, 5.6.1.0
CVE-2020-9488	Oracle Insurance Policy Administration J2EE	Architecture (Apache Log4j)	SMTPS	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	10.2.0.37, 10.2.4.12, 11.0.2.25, 11.1.0.15, 11.2.0.26
CVE-2020-9488	Oracle Insurance Rules Palette	Architecture (Apache Log4j)	SMTPS	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	10.2.0.37, 10.2.4.12, 11.0.2.25, 11.1.0.15, 11.2.0.26

Additional CVEs addressed are:

The patch for CVE-2020-11022 also addresses CVE-2019-11358 and CVE-2020-11023
The patch for CVE-2020-9546 also addresses CVE-2020-10650, CVE-2020-10672, CVE-2020-10673, CVE-2020-10968, CVE-2020-10969, CVE-2020-11111, CVE-2020-11112, CVE-2020-11113, CVE-2020-9547 and CVE-2020-9548

Oracle Java SE Risk Matrix

This Critical Patch Update contains 8 new security patches for Oracle Java SE. All of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-14803	Java SE	Libraries	Multiple	Yes	5.3	Network	Low	None	None	Un- changed	Low	None	None	Java SE: 11.0.8, 15	See Note 1
CVE-2020-14792	Java SE, Java SE Embedded	Hotspot	Multiple	Yes	4.2	Network	High	None	Required	Un- changed	Low	Low	None	Java SE: 7u271, 8u261, 11.0.8, 15; Java SE Embedded: 8u261	See Note 2
CVE-2020-14781	Java SE, Java SE Embedded	JNDI	Multiple	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	Java SE: 7u271, 8u261, 11.0.8, 15; Java SE Embedded: 8u261	See Note 2
CVE-2020-14782	Java SE, Java SE Embedded	Libraries	Multiple	Yes	3.7	Network	High	None	None	Un- changed	None	Low	None	Java SE: 7u271, 8u261, 11.0.8, 15; Java SE Embedded: 8u261	See Note 2
CVE-2020-14797	Java SE, Java SE Embedded	Libraries	Multiple	Yes	3.7	Network	High	None	None	Un- changed	None	Low	None	Java SE: 7u271, 8u261, 11.0.8, 15; Java SE Embedded: 8u261	See Note 2
CVE-2020-14779	Java SE, Java SE Embedded	Serialization	Multiple	Yes	3.7	Network	High	None	None	Un- changed	None	None	Low	Java SE: 7u271, 8u261, 11.0.8, 15; Java SE Embedded: 8u261	See Note 2
CVE-2020-14796	Java SE, Java SE Embedded	Libraries	Multiple	Yes	3.1	Network	High	None	Required	Un- changed	Low	None	None	Java SE: 7u271, 8u261, 11.0.8, 15; Java SE Embedded: 8u261	See Note 1
CVE-2020-14798	Java SE, Java SE Embedded	Libraries	Multiple	Yes	3.1	Network	High	None	Required	Un- changed	None	Low	None	Java SE: 7u271, 8u261, 11.0.8, 15; Java SE Embedded: 8u261	See Note 1

Notes:

This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).
Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.

Oracle MySQL Risk Matrix

This Critical Patch Update contains 53 new security patches plus additional third party patches noted below for Oracle MySQL. 4 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-8174	MySQL Cluster	Cluster: JS module (Node.js)	Multiple	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	7.3.30 and prior, 7.4.29 and prior, 7.5.19 and prior, 7.6.15 and prior, 8.0.21 and prior
CVE-2020-14878	MySQL Server	Server: Security: LDAP Auth	MySQL Protocol	No	8.0	Adjacent Network	Low	Low	None	Un- changed	High	High	High	8.0.21 and prior
CVE-2020-13935	MySQL Enterprise Monitor	Monitoring: General (Apache Tomcat)	HTTPS	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	8.0.21 and prior
CVE-2020-1967	MySQL Workbench	Workbench: Security: Encryption (OpenSSL)	MySQL Workbench	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	8.0.21 and prior
CVE-2020-14828	MySQL Server	Server: DML	MySQL Protocol	No	7.2	Network	Low	High	None	Un- changed	High	High	High	8.0.21 and prior
CVE-2020-14775	MySQL Server	InnoDB	MySQL Protocol	No	6.5	Network	Low	Low	None	Un- changed	None	None	High	5.7.31 and prior, 8.0.21 and prior
CVE-2020-14765	MySQL Server	Server: FTS	MySQL Protocol	No	6.5	Network	Low	Low	None	Un- changed	None	None	High	5.6.49 and prior, 5.7.31 and prior, 8.0.21 and prior
CVE-2020-14769	MySQL Server	Server: Optimizer	MySQL Protocol	No	6.5	Network	Low	Low	None	Un- changed	None	None	High	5.6.49 and prior, 5.7.31 and prior, 8.0.21 and prior
CVE-2020-14830	MySQL Server	Server: Optimizer	MySQL Protocol	No	6.5	Network	Low	Low	None	Un- changed	None	None	High	8.0.21 and prior
CVE-2020-14836	MySQL Server	Server: Optimizer	MySQL Protocol	No	6.5	Network	Low	Low	None	Un- changed	None	None	High	8.0.21 and prior
CVE-2020-14846	MySQL Server	Server: Optimizer	MySQL Protocol	No	6.5	Network	Low	Low	None	Un- changed	None	None	High	8.0.21 and prior
CVE-2020-14800	MySQL Server	Server: Security: Encryption	MySQL Protocol	No	6.5	Network	Low	Low	None	Un- changed	None	None	High	8.0.21 and prior
CVE-2020-14827	MySQL Server	Server: Security: LDAP Auth	MySQL Protocol	No	6.5	Network	Low	Low	None	Un- changed	High	None	None	5.7.31 and prior, 8.0.21 and prior
CVE-2020-14760	MySQL Server	Server: Optimizer	MySQL Protocol	No	5.5	Network	Low	High	None	Un- changed	None	Low	High	5.7.31 and prior
CVE-2020-1730	MySQL Workbench	MySQL Workbench (libssh)	MySQL Workbench	Yes	5.3	Network	Low	None	None	Un- changed	None	None	Low	8.0.21 and prior
CVE-2020-14776	MySQL Server	InnoDB	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	5.7.31 and prior, 8.0.21 and prior
CVE-2020-14821	MySQL Server	InnoDB	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.21 and prior
CVE-2020-14829	MySQL Server	InnoDB	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.21 and prior
CVE-2020-14848	MySQL Server	InnoDB	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.21 and prior
CVE-2020-14852	MySQL Server	Server: Charsets	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.21 and prior
CVE-2020-14814	MySQL Server	Server: DML	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.21 and prior
CVE-2020-14789	MySQL Server	Server: FTS	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	5.7.31 and prior, 8.0.21 and prior
CVE-2020-14804	MySQL Server	Server: FTS	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.21 and prior
CVE-2020-14812	MySQL Server	Server: Locking	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	5.6.49 and prior, 5.7.31 and prior, 8.0.21 and prior
CVE-2020-14773	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.21 and prior
CVE-2020-14777	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.21 and prior
CVE-2020-14785	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.21 and prior
CVE-2020-14793	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	5.6.49 and prior, 5.7.31 and prior, 8.0.21 and prior
CVE-2020-14794	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.21 and prior
CVE-2020-14809	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.21 and prior
CVE-2020-14837	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.21 and prior
CVE-2020-14839	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.21 and prior
CVE-2020-14845	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.21 and prior
CVE-2020-14861	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.21 and prior
CVE-2020-14866	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.21 and prior
CVE-2020-14868	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.21 and prior
CVE-2020-14888	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.21 and prior
CVE-2020-14891	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.21 and prior
CVE-2020-14893	MySQL Server	Server: Optimizer	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.21 and prior
CVE-2020-14786	MySQL Server	Server: PS	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.21 and prior
CVE-2020-14790	MySQL Server	Server: PS	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	5.7.31 and prior, 8.0.21 and prior
CVE-2020-14844	MySQL Server	Server: PS	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.21 and prior
CVE-2020-14799	MySQL Server	Server: Security: Encryption	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.20 and prior
CVE-2020-14869	MySQL Server	Server: Security: LDAP Auth	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	5.7.31 and prior, 8.0.21 and prior
CVE-2020-14672	MySQL Server	Server: Stored Procedure	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	5.6.49 and prior, 5.7.31 and prior, 8.0.21 and prior
CVE-2020-14870	MySQL Server	Server: X Plugin	MySQL Protocol	No	4.9	Network	Low	High	None	Un- changed	None	None	High	8.0.21 and prior
CVE-2020-14853	MySQL Cluster	Cluster: NDBCluster Plugin	Multiple	No	4.6	Network	Low	Low	Required	Un- changed	None	Low	Low	8.0.21 and prior
CVE-2020-14867	MySQL Server	Server: DDL	MySQL Protocol	No	4.4	Network	High	High	None	Un- changed	None	None	High	5.6.49 and prior, 5.7.31 and prior, 8.0.21 and prior
CVE-2020-14873	MySQL Server	Server: Logging	MySQL Protocol	No	4.4	Network	High	High	None	Un- changed	None	None	High	8.0.21 and prior
CVE-2020-14838	MySQL Server	Server: Security: Privileges	MySQL Protocol	No	4.3	Network	Low	Low	None	Un- changed	Low	None	None	8.0.21 and prior
CVE-2020-14860	MySQL Server	Server: Security: Roles	MySQL Protocol	No	2.7	Network	Low	High	None	Un- changed	None	Low	None	8.0.21 and prior
CVE-2020-14791	MySQL Server	InnoDB	MySQL Protocol	No	2.2	Network	High	High	None	Un- changed	None	None	Low	8.0.21 and prior
CVE-2020-14771	MySQL Server	Server: Security: LDAP Auth	MySQL Protocol	No	2.2	Network	High	High	None	Un- changed	None	None	Low	5.7.31 and prior, 8.0.21 and prior

Additional CVEs addressed are:

The patch for CVE-2020-13935 also addresses CVE-2020-11996, CVE-2020-13934 and CVE-2020-9484
The patch for CVE-2020-8174 also addresses CVE-2020-11080 and CVE-2020-8172

Additional patches are included in this Critical Patch Update for the following non-exploitable CVEs in this Oracle product family:

MySQL Cluster
- Cluster: Configuration (dojo): CVE-2020-4051

Oracle PeopleSoft Risk Matrix

This Critical Patch Update contains 15 new security patches for Oracle PeopleSoft. 12 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2018-11058	PeopleSoft Enterprise PeopleTools	Weblogic (RSA BSafe)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	8.56, 8.57, 8.58
CVE-2020-14865	PeopleSoft Enterprise SCM eSupplier Connection	eSupplier Connection	HTTP	No	8.1	Network	Low	Low	None	Un- changed	High	High	None	9.2
CVE-2020-14795	PeopleSoft Enterprise PeopleTools	PIA Core Technology	HTTP	Yes	6.5	Network	Low	None	Required	Un- changed	High	None	None	8.57, 8.58
CVE-2020-14778	PeopleSoft Enterprise HCM Global Payroll Core	Security	HTTP	No	6.3	Network	Low	Low	None	Un- changed	Low	Low	Low	9.2
CVE-2020-14832	PeopleSoft Enterprise PeopleTools	Integration Broker	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.56, 8.57, 8.58
CVE-2020-14801	PeopleSoft Enterprise PeopleTools	PIA Core Technology	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.56, 8.57, 8.58
CVE-2020-14802	PeopleSoft Enterprise PeopleTools	PIA Core Technology	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.56, 8.57, 8.58
CVE-2020-11022	PeopleSoft Enterprise PeopleTools	PIA Core Technology (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.56, 8.57, 8.58
CVE-2020-14813	PeopleSoft Enterprise PeopleTools	PIA Grids	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.56, 8.57, 8.58
CVE-2020-11022	PeopleSoft Enterprise PeopleTools	Portal, Charting (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.56, 8.57, 8.58
CVE-2020-1954	PeopleSoft Enterprise PeopleTools	Elastic Search (Apache CXF)	HTTP	Yes	5.3	Adjacent Network	High	None	None	Un- changed	High	None	None	8.56
CVE-2020-14806	PeopleSoft Enterprise PeopleTools	Query	HTTP	Yes	5.3	Network	Low	None	None	Un- changed	Low	None	None	8.56, 8.57, 8.58
CVE-2020-9488	PeopleSoft Enterprise PeopleTools	Tools Admin API (Apache Log4j)	SMTPS	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	8.56, 8.57, 8.58
CVE-2020-9488	PeopleSoft Enterprise PeopleTools	Updates Environment Mgmt (Apache Log4j)	SMTPS	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	8.56, 8.57, 8.58
CVE-2020-14847	PeopleSoft Enterprise PeopleTools	Query	HTTP	No	2.7	Network	Low	High	None	Un- changed	Low	None	None	8.56, 8.57, 8.58

Additional CVEs addressed are:

The patch for CVE-2020-11022 also addresses CVE-2020-11023

Oracle Policy Automation Risk Matrix

This Critical Patch Update contains 6 new security patches for Oracle Policy Automation. All of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-11022	Oracle Policy Automation	Core (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	12.2.0 – 12.2.20
CVE-2020-11022	Oracle Policy Automation Connector for Siebel	Core (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	10.4.6
CVE-2020-11022	Oracle Policy Automation for Mobile Devices	Core (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	12.2.0 – 12.2.20
CVE-2020-9488	Oracle Policy Automation	Core (Apache Log4j)	HTTP	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	12.2.0 – 12.2.20
CVE-2020-9488	Oracle Policy Automation Connector for Siebel	Core (Apache Log4j)	HTTP	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	10.4.6
CVE-2020-9488	Oracle Policy Automation for Mobile Devices	Core (Apache Log4j)	HTTP	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	12.2.0 – 12.2.20

Additional CVEs addressed are:

The patch for CVE-2020-11022 also addresses CVE-2020-11023

Oracle Retail Applications Risk Matrix

This Critical Patch Update contains 28 new security patches for Oracle Retail Applications. 25 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-10683	Oracle Retail Order Broker	System Administration (dom4j)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	15.0, 16.0, 18.0, 19.0, 19.1
CVE-2020-10683	Oracle Retail Price Management	Security (dom4j)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	14.0.4, 14.1.3.0, 15.0.3.0, 16.0.3.0
CVE-2020-9546	Oracle Retail Service Backbone	RSB kernel (jackson-databind)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	14.1, 15.0, 16.0
CVE-2020-1945	Oracle Retail Back Office	Security (Apache Ant)	HTTP	Yes	9.1	Network	Low	None	None	Un- changed	High	High	None	14.0, 14.1
CVE-2020-1945	Oracle Retail Central Office	Security (Apache Ant)	HTTP	Yes	9.1	Network	Low	None	None	Un- changed	High	High	None	14.0, 14.1
CVE-2020-1945	Oracle Retail Integration Bus	RIB Kernal (Apache Ant)	HTTP	Yes	9.1	Network	Low	None	None	Un- changed	High	High	None	14.1, 15.0, 16.0
CVE-2020-1945	Oracle Retail Point-of-Service	Security (Apache Ant)	HTTP	Yes	9.1	Network	Low	None	None	Un- changed	High	High	None	14.0, 14.1
CVE-2020-1945	Oracle Retail Returns Management	Security (Apache Ant)	HTTP	Yes	9.1	Network	Low	None	None	Un- changed	High	High	None	14.0, 14.1
CVE-2020-9410	Oracle Retail Order Broker	Order Broker Foundation (jasperreports_server)	HTTP	Yes	8.8	Network	Low	None	Required	Un- changed	High	High	High	15.0, 16.0
CVE-2019-3740	Oracle Retail Assortment Planning	Application Core (RSA BSAFE Crypto-J)	HTTP	Yes	6.5	Network	Low	None	Required	Un- changed	High	None	None	15.0.3.0, 16.0.3.0
CVE-2019-3740	Oracle Retail Integration Bus	RIB Kernal (RSA BSAFE Crypto-J)	HTTP	Yes	6.5	Network	Low	None	Required	Un- changed	High	None	None	14.1, 15.0, 16.0
CVE-2019-3740	Oracle Retail Predictive Application Server	RPAS Server (RSA BSAFE Crypto-J)	HTTP	Yes	6.5	Network	Low	None	Required	Un- changed	High	None	None	14.1.3.0, 15.0.3.0, 16.0.3.0
CVE-2019-3740	Oracle Retail Service Backbone	RSB kernel (RSA BSAFE Crypto-J)	HTTP	Yes	6.5	Network	Low	None	Required	Un- changed	High	None	None	14.1, 15.0, 16.0
CVE-2019-3740	Oracle Retail Xstore Point of Service	Xenvironment (RSA BSAFE Crypto-J)	HTTP	Yes	6.5	Network	Low	None	Required	Un- changed	High	None	None	15.0.3, 16.0.5, 17.0.3, 18.0.2, 19.0.1
CVE-2020-11022	Oracle Retail Back Office	Security (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	14.0, 14.1
CVE-2020-11022	Oracle Retail Central Office	Security (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	14.0, 14.1
CVE-2020-11022	Oracle Retail Customer Management and Segmentation Foundation	Segments (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	19.0
CVE-2019-11358	Oracle Retail Point-of-Service	Mobile POS (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	14.0, 14.1
CVE-2020-11022	Oracle Retail Returns Management	Security (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	14.0, 14.1
CVE-2019-12415	Oracle Retail Order Broker	Store Connect (Apache POI)	none	No	5.5	Local	Low	Low	None	Un- changed	High	None	None	15.0, 16.0
CVE-2020-9488	Oracle Retail Advanced Inventory Planning	AIP Dashboard (Apache Log4j)	HTTP	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	14.1
CVE-2020-9488	Oracle Retail Assortment Planning	Application Core (Apache Log4j)	HTTP	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	15.0.3.0, 16.0.3.0
CVE-2020-9488	Oracle Retail Bulk Data Integration	BDI Job Scheduler (Apache Log4j)	HTTP	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	15.0.3.0, 16.0.3.0
CVE-2020-9488	Oracle Retail Integration Bus	RIB Kernal (Apache Log4j)	HTTP	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	14.1, 15.0, 16.0
CVE-2020-9488	Oracle Retail Order Broker	Store Connect (Apache Log4j)	HTTP	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	16.0, 18.0, 19.0, 19.1, 19.2, 19.3
CVE-2020-9488	Oracle Retail Predictive Application Server	RPAS Fusion Client (Apache Log4j)	HTTP	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	14.1.3.0, 15.0.3.0, 16.0.3.0
CVE-2020-14732	Oracle Retail Customer Management and Segmentation Foundation	Promotions	HTTP	No	3.1	Network	High	Low	None	Un- changed	Low	None	None	19.0
CVE-2020-14731	Oracle Retail Customer Management and Segmentation Foundation	Segment	HTTP	No	3.1	Network	High	Low	None	Un- changed	Low	None	None	18.0, 19.0

Additional CVEs addressed are:

The patch for CVE-2019-3740 also addresses CVE-2019-3738 and CVE-2019-3739
The patch for CVE-2020-11022 also addresses CVE-2020-11023
The patch for CVE-2020-1945 also addresses CVE-2017-5645
The patch for CVE-2020-9410 also addresses CVE-2020-9409
The patch for CVE-2020-9546 also addresses CVE-2020-10650, CVE-2020-10672, CVE-2020-10673, CVE-2020-10968, CVE-2020-10969, CVE-2020-11111, CVE-2020-11112, CVE-2020-11113, CVE-2020-9547 and CVE-2020-9548

Oracle Siebel CRM Risk Matrix

This Critical Patch Update contains 3 new security patches for Oracle Siebel CRM. All of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2016-1000031	Siebel Apps – Marketing	Mktg/Email Mktg Stand-Alone (Apache Commons File Upload)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	20.7
CVE-2019-10072	Siebel Apps – Marketing	Mktg/Campaign Mgmt (Apache Tomcat)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	20.7
CVE-2020-11022	Siebel UI Framework	UIF Open UI (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	20.8

Additional CVEs addressed are:

The patch for CVE-2020-11022 also addresses CVE-2020-11023

Oracle Supply Chain Risk Matrix

This Critical Patch Update contains 4 new security patches for Oracle Supply Chain. 3 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-1938	Oracle Agile PLM	Folders, Files & Attachments (Apache Tomcat)	AJP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	9.3.3, 9.3.5, 9.3.6
CVE-2020-10683	Oracle Agile PLM	Security (dom4j)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	9.3.3, 9.3.5
CVE-2020-9484	Oracle Transportation Management	Install (Apache Tomcat)	AJP	No	7.0	Local	High	Low	None	Un- changed	High	High	High	6.3.7
CVE-2020-11022	Oracle Agile Product Lifecycle Management for Process	Supplier Portal (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	6.2.0.0

Additional CVEs addressed are:

The patch for CVE-2020-11022 also addresses CVE-2020-11023
The patch for CVE-2020-1938 also addresses CVE-2019-17569, CVE-2020-13934, CVE-2020-13935, CVE-2020-1935 and CVE-2020-9484

Oracle Systems Risk Matrix

This Critical Patch Update contains 8 new security patches for Oracle Systems. 3 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-14871	Oracle Solaris	Pluggable authentication module	Multiple	Yes	10.0	Network	Low	None	None	Changed	High	High	High	10, 11	See Note 1
CVE-2020-14871	Oracle ZFS Storage Appliance Kit	Operating System Image	Multiple	Yes	10.0	Network	Low	None	None	Changed	High	High	High	8.8	See Note 1
CVE-2019-11477	Fujitsu M10-1, M10-4, M10-4S, M12-1, M12-2, M12-2S Servers	XCP Firmware (Linux Kernel)	TCP	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	Prior to XCP2362, prior to XCP3090
CVE-2018-3693	Fujitsu M12-1, M12-2, M12-2S Servers	XCP Firmware (Kernel)	None	No	5.6	Local	High	Low	None	Changed	High	None	None	Prior to XCP3090
CVE-2020-14758	Oracle Solaris	Kernel	None	No	5.6	Local	Low	Low	Required	Un- changed	High	None	Low	11
CVE-2020-14754	Oracle Solaris	Filesystem	None	No	5.5	Local	Low	Low	None	Un- changed	None	None	High	11
CVE-2020-14818	Oracle Solaris	Utility	SSH	No	3.0	Network	High	Low	Required	Changed	None	Low	None	11
CVE-2020-14759	Oracle Solaris	Kernel	None	No	2.5	Local	High	Low	Required	Changed	None	Low	None	11

Notes:

This CVE is not exploitable for Solaris 11.1 and later releases, and ZFSSA 8.7 and later releases, thus the CVSS Base Score is 0.0.

Additional CVEs addressed are:

The patch for CVE-2019-11477 also addresses CVE-2019-11478 and CVE-2019-11479
The patch for CVE-2020-14871 for Oracle ZFS Storage Appliance Kit also addresses CVE-2019-18348, CVE-2020-3909, CVE-2020-10108, CVE-2020-12243, CVE-2020-13630, CVE-2020-14758 and CVE-2020-14759

Oracle Utilities Applications Risk Matrix

This Critical Patch Update contains 5 new security patches for Oracle Utilities Applications. 3 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2019-10173	Oracle Utilities Framework	Common (xstream)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	2.2.0.0.0, 4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0 – 4.3.0.6.0, 4.4.0.0.0
CVE-2020-10683	Oracle Utilities Framework	General (dom4j)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	2.2.0.0.0, 4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0 – 4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0
CVE-2020-1945	Oracle Utilities Framework	General (Apache Ant)	None	No	6.3	Local	High	Low	None	Un- changed	High	High	None	2.2.0.0.0, 4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0 – 4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0
CVE-2020-14895	Oracle Utilities Framework	System Wide	HTTP	No	5.4	Network	Low	Low	None	Un- changed	Low	Low	None	2.2.0.0.0, 4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0 – 4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0
CVE-2020-9488	Oracle Utilities Framework	Common (Apache Log4j)	HTTP	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	2.2.0.0.0, 4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0 – 4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0

Additional CVEs addressed are:

The patch for CVE-2020-1945 also addresses CVE-2017-5645

Oracle Virtualization Risk Matrix

This Critical Patch Update contains 7 new security patches for Oracle Virtualization. None of these vulnerabilities may be remotely exploitable without authentication, i.e., none may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-14872	Oracle VM VirtualBox	Core	None	No	8.2	Local	Low	High	None	Changed	High	High	High	Prior to 6.1.16
CVE-2020-14881	Oracle VM VirtualBox	Core	None	No	6.0	Local	Low	High	None	Changed	High	None	None	Prior to 6.1.16
CVE-2020-14884	Oracle VM VirtualBox	Core	None	No	6.0	Local	Low	High	None	Changed	High	None	None	Prior to 6.1.16
CVE-2020-14885	Oracle VM VirtualBox	Core	None	No	6.0	Local	Low	High	None	Changed	High	None	None	Prior to 6.1.16
CVE-2020-14886	Oracle VM VirtualBox	Core	None	No	6.0	Local	Low	High	None	Changed	High	None	None	Prior to 6.1.16
CVE-2020-14889	Oracle VM VirtualBox	Core	None	No	6.0	Local	Low	High	None	Changed	High	None	None	Prior to 6.1.16
CVE-2020-14892	Oracle VM VirtualBox	Core	None	No	5.5	Local	Low	Low	None	Un- changed	None	None	High	Prior to 6.1.16

No Related Posts

Oracle Security Alert for CVE-2020-14750 – 01 November 2020

September 30, 2020September 28, 2021 Oracle Leave a comment

Oracle Security Alert Advisory – CVE-2020-14750

Description

This Security Alert addresses CVE-2020-14750, a remote code execution vulnerability in Oracle WebLogic Server. This vulnerability is related to CVE-2020-14882, which was addressed in the October 2020 Critical Patch Update. It is remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password.

Due to the severity of this vulnerability and the publication of exploit code on various sites, Oracle strongly recommends that customers apply the updates provided by this Security Alert as soon as possible.

Affected Products and Patch Information

Security vulnerabilities addressed by this Security Alert affect the products listed below. The product area is shown in the Patch Availability Document column.

Please click on the links in the Patch Availability Document column below to access the documentation for patch availability information and installation instructions.

Affected Products and Versions	Patch Availability Document
Oracle WebLogic Server, versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0	Fusion Middleware

Security Alert Supported Products and Versions

Patches released through the Security Alert program are provided only for product versions that are covered under the Premier Support or Extended Support phases of the Lifetime Support Policy. Oracle recommends that customers plan product upgrades to ensure that patches released through the Security Alert program are available for the versions they are currently running.

Product releases that are not under Premier Support or Extended Support are not tested for the presence of vulnerabilities addressed by this Security Alert. However, it is likely that earlier versions of affected releases are also affected by these vulnerabilities. As a result, Oracle recommends that customers upgrade to supported versions.

Database, Fusion Middleware, Oracle Enterprise Manager products are patched in accordance with the Software Error Correction Support Policy explained in My Oracle Support Note 209768.1. Please review the Technical Support Policies for further guidelines regarding support policies and phases of support.

References

Risk Matrix Content

Security vulnerabilities are scored using CVSS version 3.1 (see Oracle CVSS Scoring for an explanation of how Oracle applies CVSS version 3.1).

Oracle conducts an analysis of each security vulnerability addressed by a Security Alert. Oracle does not disclose detailed information about this security analysis to customers, but the resulting Risk Matrix and associated documentation provide information about the type of vulnerability, the conditions required to exploit it, and the potential impact of a successful exploit. Oracle provides this information, in part, so that customers may conduct their own risk analysis based on the particulars of their product usage. For more information, see Oracle vulnerability disclosure policies.

Credit Statement

The following people or organizations reported security vulnerabilities addressed by this Security Alert to Oracle:

360QUAKE TEAM: CVE-2020-14750
Bui Dinh Bao aka 0xd0ff9 of Zalo Security Team (VNG Corp): CVE-2020-14750
codeplutos of AntGroup FG Security Lab: CVE-2020-14750
f1v3 jacky: CVE-2020-14750
Hoang Quoc Thinh of RedTeam (VNG Corp): CVE-2020-14750
Huang Xiaopeng of 360CERT at QiHu360: CVE-2020-14750
icez of Tophant Competence Center: CVE-2020-14750
Jacky Xing of Dbappsecurity Team: CVE-2020-14750
Maoxin Lin of Dbappsecurity Team: CVE-2020-14750
mayoterry of Qingteng 73Lab Security Team: CVE-2020-14750
ph4nt0mer: CVE-2020-14750
r00t4dm from A-TEAM of Legendsec at Qi’anxin Group: CVE-2020-14750
Shimizu Kawasaki of Asiainfo-sec of CSS Group: CVE-2020-14750
tcc: CVE-2020-14750
Tonghua Root: CVE-2020-14750
voidfyoo of Chaitin Security Research Lab: CVE-2020-14750
Xianglai Liu of Dbappsecurity Team: CVE-2020-14750
Yu Wang of BMH Security Team: CVE-2020-14750
Yuxuan Chen: CVE-2020-14750
Zhiyi Zhang from Codesafe Team of Legendsec at Qi’anxin Group: CVE-2020-14750

Modification History

Date	Note
2020-November-6	Rev 2. Credit update.
2020-November-1	Rev 1. Initial Release.

Oracle Fusion Middleware Risk Matrix

This Security Alert contains 1 new security patch for Oracle Fusion Middleware. This vulnerability is remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

Oracle Fusion Middleware products include Oracle Database components that are affected by the vulnerabilities listed in the Oracle Database section. The exposure of Oracle Fusion Middleware products is dependent on the Oracle Database version being used. Oracle Database security updates are not listed in the Oracle Fusion Middleware risk matrix. However, since vulnerabilities affecting Oracle Database versions may affect Oracle Fusion Middleware products, Oracle recommends that customers apply the Security Alert CVE-2020-14750 to the Oracle Database components of Oracle Fusion Middleware products. For information on what patches need to be applied to your environments, refer to Security Alert CVE-2020-14750 Patch Availability Document for Oracle Products, My Oracle Support Note 2724951.1.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-14750	Oracle WebLogic Server	Console	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0

No Related Posts

Oracle Critical Patch Update Advisory – July 2020

July 13, 2020September 28, 2021 Oracle Leave a comment

Oracle Critical Patch Update Advisory – July 2020

Description

A Critical Patch Update is a collection of patches for multiple security vulnerabilities. These patches are usually cumulative, but each advisory describes only the security patches added since the previous Critical Patch Update Advisory. Thus, prior Critical Patch Update advisories should be reviewed for information regarding earlier published security patches. Please refer to:

Critical Patch Updates, Security Alerts and Bulletins for information about Oracle Security advisories.

This Critical Patch Update contains 444 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at July 2020 Critical Patch Update: Executive Summary and Analysis.

Affected Products and Patch Information

Security vulnerabilities addressed by this Critical Patch Update affect the products listed below. The product area is shown in the Patch Availability Document column.

Please click on the links in the Patch Availability Document column below to access the documentation for patch availability information and installation instructions.

Affected Products and Versions	Patch Availability Document
Category Management Planning & Optimization, version 15.0.3	Retail Applications
Customer Management and Segmentation Foundation, versions 16.0, 17.0, 18.0	Retail Applications
Enterprise Manager Base Platform, versions 12.1.0.5, 13.3.0.0, 13.4.0.0	Enterprise Manager
Enterprise Manager for Fusion Middleware, version 12.1.0.5	Enterprise Manager
Enterprise Manager Ops Center, version 12.4.0.0	Enterprise Manager
GoldenGate Stream Analytics, versions prior to 19.1.0.0.1	Database
Hyperion Financial Close Management, version 11.1.2.4	Fusion Middleware
Instantis EnterpriseTrack, versions 17.1-17.3	Oracle Construction and Engineering Suite
JD Edwards EnterpriseOne Orchestrator, versions prior to 9.2.4.2	JD Edwards
JD Edwards EnterpriseOne Tools, versions prior to 9.2.3.3, prior to 9.2.4.2	JD Edwards
MySQL Client, versions 5.6.48 and prior, 5.7.30 and prior, 8.0.20 and prior	MySQL
MySQL Cluster, versions 7.3.29 and prior, 7.4.28 and prior, 7.5.18 and prior, 7.6.14 and prior, 8.0.20 and prior	MySQL
MySQL Connectors, versions 8.0.20 and prior	MySQL
MySQL Enterprise Monitor, versions 4.0.12 and prior, 8.0.20 and prior	MySQL
MySQL Server, versions 5.6.48 and prior, 5.7.30 and prior, 8.0.20 and prior	MySQL
Oracle Agile Engineering Data Management, version 6.2.1.0	Oracle Supply Chain Products
Oracle Application Express, versions 5.1-19.2	Database
Oracle Application Testing Suite, versions 13.2.0.1, 13.3.0.1	Enterprise Manager
Oracle AutoVue, version 21.0	Oracle Supply Chain Products
Oracle Banking Enterprise Collections, versions 2.7.0-2.9.0	Oracle Banking Platform
Oracle Banking Payments, versions 14.1.0-14.4.0	Oracle Financial Services Applications
Oracle Banking Platform, versions 2.4.0-2.10.0	Oracle Banking Platform
Oracle Berkeley DB, versions prior to 6.1.38, prior to 18.1.40	Berkeley DB
Oracle BI Publisher, versions 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Oracle Business Intelligence Enterprise Edition, versions 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Oracle Business Process Management Suite, versions 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Oracle Coherence, versions 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0	Fusion Middleware
Oracle Commerce Guided Search / Oracle Commerce Experience Manager, versions 11.0, 11.1, 11.2, prior to 11.3.1	Oracle Commerce
Oracle Commerce Platform, versions 11.1, 11.2, prior to 11.3.1	Oracle Commerce
Oracle Commerce Service Center, versions 11.1, 11.2, prior to 11.3.1	Oracle Commerce
Oracle Communications Analytics, version 12.1.1	Oracle Communications Analytics
Oracle Communications Billing and Revenue Management, versions 7.5.0.23.0, 12.0.0.3.0	Oracle Communications Billing and Revenue Management
Oracle Communications BRM – Elastic Charging Engine, versions 11.3, 12.0	Oracle Communications BRM – Elastic Charging Engine
Oracle Communications Contacts Server, version 8.0.0.4.0	Oracle Communications Contacts Server
Oracle Communications Convergence, versions 3.0.1.0-3.0.2.1	Oracle Communications Convergence
Oracle Communications Diameter Signaling Router (DSR), versions 8.0-8.4	Oracle Communications Diameter Signaling Router
Oracle Communications Element Manager, versions 8.1.1, 8.2.0, 8.2.1	Oracle Communications Element Manager
Oracle Communications Evolved Communications Application Server, version 7.1	Oracle Communications Evolved Communications Application Server
Oracle Communications Instant Messaging Server, version 10.0.1.4.0	Oracle Communications Instant Messaging Server
Oracle Communications Interactive Session Recorder, versions 6.1-6.4	Oracle Communications Interactive Session Recorder
Oracle Communications IP Service Activator, versions 7.3.0, 7.4.0	Oracle Communications IP Service Activator
Oracle Communications LSMS, versions 13.0-13.3	Oracle Communications LSMS
Oracle Communications Messaging Server, versions 8.0.2, 8.1.0	Oracle Communications Messaging Server
Oracle Communications MetaSolv Solution, version 6.3.0	Oracle Communications MetaSolv Solution
Oracle Communications Network Charging and Control, versions 6.0.1, 12.0.0-12.0.3	Oracle Communications Network Charging and Control
Oracle Communications Network Integrity, versions 7.3.2-7.3.6	Oracle Communications Network Integrity
Oracle Communications Operations Monitor, versions 3.4, 4.1-4.3	Oracle Communications Operations Monitor
Oracle Communications Order and Service Management, versions 7.3, 7.4	Oracle Communications Order and Service Management
Oracle Communications Services Gatekeeper, versions 6.0, 6.1, 7.0	Oracle Communications Services Gatekeeper
Oracle Communications Session Border Controller, versions 8.1.0, 8.2.0, 8.3.0	Oracle Communications Session Border Controller
Oracle Communications Session Report Manager, versions 8.1.1, 8.2.0, 8.2.1	Oracle Communications Session Report Manager
Oracle Communications Session Route Manager, versions 8.1.1, 8.2.0, 8.2.1	Oracle Communications Session Route Manager
Oracle Configuration Manager, version 12.1.2.0.6	Enterprise Manager
Oracle Configurator, versions 12.1, 12.2	Oracle Supply Chain Products
Oracle Data Masking and Subsetting, versions 13.3.0.0, 13.4.0.0	Enterprise Manager
Oracle Database Server, versions 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, 19c, [Spatial Studio] prior to 19.2.1	Database
Oracle E-Business Suite, versions 12.1.1-12.1.3, 12.2.3-12.2.9	E-Business Suite
Oracle Endeca Information Discovery Studio, version 3.2.0	Fusion Middleware
Oracle Enterprise Communications Broker, versions 3.0.0-3.2.0	Oracle Enterprise Communications Broker
Oracle Enterprise Repository, version 11.1.1.7.0	Fusion Middleware
Oracle Enterprise Session Border Controller, versions 8.1.0, 8.2.0, 8.3.0	Oracle Enterprise Session Border Controller
Oracle Financial Services Analytical Applications Infrastructure, versions 8.0.6-8.1.0	Oracle Financial Services Analytical Applications Infrastructure
Oracle Financial Services Compliance Regulatory Reporting, versions 8.0.6-8.0.8	Oracle Financial Services Compliance Regulatory Reporting
Oracle Financial Services Lending and Leasing, versions 12.5.0, 14.1.0-14.8.0	Oracle Financial Services Applications
Oracle Financial Services Liquidity Risk Management, version 8.0.6	Oracle Financial Services Liquidity Risk Management
Oracle Financial Services Loan Loss Forecasting and Provisioning, versions 8.0.6-8.0.8	Oracle Financial Services Loan Loss Forecasting and Provisioning
Oracle Financial Services Market Risk Measurement and Management, versions 8.0.6, 8.0.8	Oracle Financial Services Market Risk Measurement and Management
Oracle Financial Services Regulatory Reporting for De Nederlandsche Bank, version 8.0.4	Oracle Financial Services Regulatory Reporting for De Nederlandsche Bank
Oracle FLEXCUBE Investor Servicing, versions 12.1.0, 12.3.0, 12.4.0, 14.0.0, 14.1.0	Oracle Financial Services Applications
Oracle FLEXCUBE Private Banking, versions 12.0.0, 12.1.0	Oracle Financial Services Applications
Oracle Fusion Middleware MapViewer, versions 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Oracle Global Lifecycle Management/OPatch, versions prior to 12.2.0.1.20	Global Lifecycle Management
Oracle GoldenGate, versions prior to 19.1.0.0.0	Database
Oracle GraalVM Enterprise Edition, versions 19.3.2, 20.1.0	Oracle GraalVM Enterprise Edition
Oracle Health Sciences Empirica Inspections, version 1.0.1.2	Health Sciences
Oracle Health Sciences Empirica Signal, version 7.3.3	Health Sciences
Oracle Healthcare Master Person Index, version 4.0.2	Health Sciences
Oracle Healthcare Translational Research, versions 3.2.1, 3.3.1, 3.3.2, 3.4.0	Health Sciences
Oracle Help Technologies, versions 11.1.1.9.0, 12.2.1.3.0	Fusion Middleware
Oracle Hospitality Guest Access, versions 4.2.0, 4.2.1	Oracle Hospitality Guest Access
Oracle Hospitality Reporting and Analytics, version 9.1.0	Oracle Hospitality Reporting and Analytics
Oracle Hyperion BI+, version 11.1.2.4	Fusion Middleware
Oracle iLearning, versions 6.1, 6.1.1	iLearning
Oracle Insurance Accounting Analyzer, versions 8.0.6-8.0.9	Oracle Insurance Accounting Analyzer
Oracle Insurance Data Gateway, version 1.0	Oracle Insurance Applications
Oracle Insurance Policy Administration J2EE, versions 10.2.0, 10.2.4, 11.0.2, 11.1.0, 11.2.0	Oracle Insurance Applications
Oracle Insurance Rules Palette, versions 10.2.0, 10.2.4, 11.0.2, 11.1.0, 11.2.0	Oracle Insurance Applications
Oracle Java SE, versions 7u261, 8u251, 11.0.7, 14.0.1	Java SE
Oracle Java SE Embedded, version 8u251	Java SE
Oracle Outside In Technology, versions 8.5.4, 8.5.5	Fusion Middleware
Oracle Rapid Planning, versions 12.1, 12.2	Oracle Supply Chain Products
Oracle Real User Experience Insight, version 13.3.1.0	Enterprise Manager
Oracle Retail Assortment Planning, versions 15.0, 15.0.3, 16.0, 16.0.3	Retail Applications
Oracle Retail Bulk Data Integration, versions 15.0, 16.0	Retail Applications
Oracle Retail Customer Management and Segmentation Foundation, version 18.0	Retail Applications
Oracle Retail Data Extractor for Merchandising, versions 1.9, 1.10, 18.0	Retail Applications
Oracle Retail Extract Transform and Load, version 19.0	Retail Applications
Oracle Retail Financial Integration, versions 15.0, 16.0	Retail Applications
Oracle Retail Fusion Platform, version 5.5	Retail Applications
Oracle Retail Integration Bus, versions 15.0, 15.0.3, 16.0, 16.0.3	Retail Applications
Oracle Retail Invoice Matching, version 16.0	Retail Applications
Oracle Retail Item Planning, version 15.0.3	Retail Applications
Oracle Retail Macro Space Optimization, version 15.0.3	Retail Applications
Oracle Retail Merchandise Financial Planning, version 15.0.3	Retail Applications
Oracle Retail Merchandising System, versions 15.0.3, 16.0.2, 16.0.3	Retail Applications
Oracle Retail Order Broker, version 15.0	Retail Applications
Oracle Retail Predictive Application Server, versions 14.0.3, 14.1.3, 15.0.3, 16.0.3	Retail Applications
Oracle Retail Regular Price Optimization, versions 15.0.3, 16.0.3	Retail Applications
Oracle Retail Replenishment Optimization, version 15.0.3	Retail Applications
Oracle Retail Sales Audit, version 14.1	Retail Applications
Oracle Retail Service Backbone, versions 14.1, 15.0, 16.0	Retail Applications
Oracle Retail Size Profile Optimization, version 15.0.3	Retail Applications
Oracle Retail Store Inventory Management, versions 14.0.4, 14.1.3, 15.0.3, 16.0.3	Retail Applications
Oracle Retail Xstore Point of Service, versions 7.1, 15.0, 16.0, 17.0, 18.0, 19.0	Retail Applications
Oracle SD-WAN Aware, versions 8.0, 8.1, 8.2	Oracle SD-WAN Aware
Oracle SD-WAN Edge, versions 8.0, 8.1, 8.2, 9.0	Oracle SD-WAN Edge
Oracle Security Service, versions 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Oracle Solaris, version 11	Systems
Oracle TimesTen In-Memory Database, versions prior to 18.1.2.1.0	Database
Oracle Transportation Management, versions 6.3.7, 6.4.3	Oracle Supply Chain Products
Oracle Unified Directory, versions 11.1.2.3.0, 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Oracle Utilities Framework, versions 4.3.0.5.0, 4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0	Oracle Utilities Applications
Oracle VM VirtualBox, versions prior to 5.2.44, prior to 6.0.24, prior to 6.1.12	Virtualization
Oracle WebCenter Portal, versions 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Oracle WebCenter Sites, versions 12.2.1.3.0, 12.2.1.4.0	Fusion Middleware
Oracle WebLogic Server, versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0	Fusion Middleware
Oracle ZFS Storage Appliance Kit, version 8.8	Systems
PeopleSoft Enterprise FIN Expenses, version 9.2	PeopleSoft
PeopleSoft Enterprise HCM Global Payroll Switzerland, version 9.2	PeopleSoft
PeopleSoft Enterprise HRMS, version 9.2	PeopleSoft
PeopleSoft Enterprise PeopleTools, versions 8.56, 8.57, 8.58	PeopleSoft
Primavera Gateway, versions 16.2.0-16.2.11, 17.12.0-17.12.7, 18.8.0-18.8.9, 19.12.0-19.12.4	Oracle Construction and Engineering Suite
Primavera P6 Enterprise Project Portfolio Management, versions 16.1.0.0-16.2.20.1, 17.1.0.0-17.12.17.1, 18.1.0.0-18.8.19, 19.12.0-19.12.6	Oracle Construction and Engineering Suite
Primavera Portfolio Management, versions 16.1.0.0-16.1.5.1, 18.0.0.0-18.0.2.0, 19.0.0.0	Oracle Construction and Engineering Suite
Primavera Unifier, versions 16.1, 16.2, 17.7-17.12, 18.8, 19.12, [Mobile App] prior to 20.6	Oracle Construction and Engineering Suite
Siebel Applications, versions 2.20.5 and prior, 20.6 and prior	Siebel

Note:

Vulnerabilities affecting either Oracle Database or Oracle Fusion Middleware may affect Oracle Fusion Applications, so Oracle customers should refer to Oracle Fusion Applications Critical Patch Update Knowledge Document, My Oracle Support Note 1967316.1 for information on patches to be applied to Fusion Application environments.
Vulnerabilities affecting Oracle Solaris may affect Oracle ZFSSA so Oracle customers should refer to the Oracle and Sun Systems Product Suite Critical Patch Update Knowledge Document, My Oracle Support Note 2160904.1 for information on minimum revisions of security patches required to resolve ZFSSA issues published in Critical Patch Updates and Solaris Third Party bulletins.
Solaris Third Party Bulletins are used to announce security patches for third party software distributed with Oracle Solaris. Solaris 10 customers should refer to the latest patch-sets which contain critical security fixes and detailed in Systems Patch Availability Document. Please see Reference Index of CVE IDs and Solaris Patches (My Oracle Support Note 1448883.1) for more information.
Users running Java SE with a browser can download the latest release from https://java.com. Users on the Windows and Mac OS X platforms can also use automatic updates to get the latest release.

Risk Matrix Content

Security vulnerabilities are scored using CVSS version 3.1 (see Oracle CVSS Scoring for an explanation of how Oracle applies CVSS version 3.1).

Workarounds

Skipped Critical Patch Updates

Critical Patch Update Supported Products and Versions

Credit Statement

The following people or organizations reported security vulnerabilities addressed by this Critical Patch Update to Oracle:

Abdullah Alzahrani: CVE-2020-14554, CVE-2020-14635
Alessandro Bosco of TIM S.p.A: CVE-2020-14690
Alexander Kornbrust of Red Database Security: CVE-2020-2984
Alves Christopher (Telecom Nancy): CVE-2020-14550, CVE-2020-14553, CVE-2020-14623
Ammarit Thongthua of Secure D Center Cybersecurity Team: CVE-2020-14558, CVE-2020-14564
Andrej Simko of Accenture: CVE-2020-14534, CVE-2020-14555, CVE-2020-14590, CVE-2020-14657, CVE-2020-14658, CVE-2020-14659, CVE-2020-14660, CVE-2020-14661, CVE-2020-14665, CVE-2020-14666, CVE-2020-14667, CVE-2020-14679, CVE-2020-14688
Antonin B. of NCIA / NCSC: CVE-2020-14610
Arseniy Sharoglazov of Positive Technologies: CVE-2020-14622
Artur Wojtkowski and CQURE Team: CVE-2020-14617, CVE-2020-14618
Billy Cody of Context Information Security: CVE-2020-14595
Bui Duong from Viettel Cyber Security: CVE-2020-14611
CERT/CC: CVE-2020-14558
Chathura Abeydeera of Deloitte Risk Advisory Pty Ltd: CVE-2020-14531
Chi Tran: CVE-2020-14534, CVE-2020-14716, CVE-2020-14717
Conor McErlane working with Trend Micro’s Zero Day Initiative: CVE-2020-14628
Damian Bury: CVE-2020-14546
Edoardo Predieri of TIM S.p.A: CVE-2020-14690
Emad Al-Mousa of Saudi Aramco: CVE-2020-2969, CVE-2020-2978
Fabio Minarelli of TIM S.p.A: CVE-2020-14690
Filip Ceglik: CVE-2020-14560, CVE-2020-14565
Forum Bhayani: CVE-2020-14592
Francesco Russo of TIM S.p.A: CVE-2020-14690
Giovanni Delvecchio of Almaviva Security Assessment Team: CVE-2020-14607, CVE-2020-14608
Hangfan Zhang: CVE-2020-14575, CVE-2020-14654
Hugo Santiago dos Santos: CVE-2020-14613
Johannes Kuhn: CVE-2020-14556
Julien Zhan (Telecom Nancy): CVE-2020-14550, CVE-2020-14553, CVE-2020-14623
kdot working with Trend Micro Zero Day Initiative: CVE-2020-14664
Khuyen Nguyen of secgit.com: CVE-2020-14668, CVE-2020-14669, CVE-2020-14670, CVE-2020-14671, CVE-2020-14681, CVE-2020-14682, CVE-2020-14686
Kingkk: CVE-2020-14642, CVE-2020-14644
Kritsada Sunthornwutthikrai of Secure D Center Cybersecurity Team: CVE-2020-14558, CVE-2020-14564
Larry W. Cashdollar: CVE-2020-14724
Lionel Debroux: CVE-2020-2981
Luca Di Giuseppe of TIM S.p.A: CVE-2020-14690
Lucas Leong of Trend Micro Zero Day Initiative: CVE-2020-14646, CVE-2020-14647, CVE-2020-14648, CVE-2020-14649, CVE-2020-14650, CVE-2020-14673, CVE-2020-14674, CVE-2020-14694, CVE-2020-14695, CVE-2020-14703, CVE-2020-14704
lufei of Tencent Force: CVE-2020-14645
Lukas Braune of Siemens: CVE-2019-8457
Lukasz Mikula: CVE-2020-14541
Lukasz Rupala of ING Tech Poland: CVE-2020-14552
Maoxin Lin of Dbappsecurity Team: CVE-2020-14645, CVE-2020-14652
Marco Marsala: CVE-2020-14559
Markus Loewe: CVE-2020-14583
Markus Wulftange of Code White GmbH: CVE-2020-14644, CVE-2020-14645, CVE-2020-14687
Massimiliano Brolli of TIM S.p.A: CVE-2020-14690
Mateusz Dabrowski: CVE-2020-14584, CVE-2020-14585
Maxime Escourbiac of Michelin CERT: CVE-2020-14719, CVE-2020-14720
Mohamed Fadel: CVE-2020-14601, CVE-2020-14602, CVE-2020-14603, CVE-2020-14604, CVE-2020-14605
Ntears of Chaitin Security Team: CVE-2020-14645, CVE-2020-14652
Owais Zaman of Sabic: CVE-2020-14551
Pavel Cheremushkin: CVE-2020-14713
Philippe Antoine (Telecom Nancy): CVE-2020-14550, CVE-2020-14553, CVE-2020-14623
Philippe Arteau of GoSecure: CVE-2020-14577
Preeyakorn Keadsai of Secure D Center Cybersecurity Team: CVE-2020-14558, CVE-2020-14564
Przemyslaw Nowakowski: CVE-2020-2977
Quynh Le of VNPT ISC working with Trend Micro Zero Day Initiative: CVE-2020-14625
r00t4dm from A-TEAM of Legendsec at Qi’anxin Group: CVE-2020-14636, CVE-2020-14637, CVE-2020-14638, CVE-2020-14639, CVE-2020-14640, CVE-2020-14645, CVE-2020-14652
Reno Robert working with Trend Micro Zero Day Initiative: CVE-2020-14629, CVE-2020-14675, CVE-2020-14676, CVE-2020-14677
Roberto Suggi Liverani of NCIA / NCSC: CVE-2020-14610
Roger Meyer: CVE-2020-2513, CVE-2020-2971, CVE-2020-2972, CVE-2020-2973, CVE-2020-2974, CVE-2020-2975, CVE-2020-2976
Roman Shemyakin: CVE-2020-14621
Rui Zhong: CVE-2020-14575, CVE-2020-14654
Saeed Shiravi: CVE-2020-14548
Shimizu Kawasaki of Asiainfo-sec of CSS Group: CVE-2020-14645, CVE-2020-14652
Spyridon Chatzimichail of OTE Hellenic Telecommunications Organization S.A.: CVE-2020-14532, CVE-2020-14533
Suthum Thitiananpakorn: CVE-2020-14569
Ted Raffle of rapid7.com: CVE-2020-14535, CVE-2020-14536
Tomasz Stachowicz: CVE-2020-14570, CVE-2020-14571
Trung Le: CVE-2020-14534, CVE-2020-14716, CVE-2020-14717
Tuan Anh Nguyen of Viettel Cyber Security: CVE-2020-14598, CVE-2020-14599
Vijayakumar Muniraj of CybersecurityWorks Research Labs: CVE-2020-14723
Yaoguang Chen of Ant-financial Light-Year Security Lab: CVE-2020-14654, CVE-2020-14725
Yongheng Chen: CVE-2020-14575, CVE-2020-14654
ZeddYu Lu of StarCross Tech: CVE-2020-14588, CVE-2020-14589
Zhao Xin Jun: CVE-2020-14652
Zhongcheng Li (CK01) from Zero-dayits Team of Legendsec at Qi’anxin Group: CVE-2020-14711, CVE-2020-14712
Ziming Zhang from Codesafe Team of Legendsec at Qi’anxin Group: CVE-2020-14707, CVE-2020-14714, CVE-2020-14715
Ziming Zhang from Codesafe Team of Legendsec at Qi’anxin Group working with Trend Micro Zero Day Initiative: CVE-2020-14698, CVE-2020-14699, CVE-2020-14700
Zouhair Janatil-Idrissi (Telecom Nancy): CVE-2020-14550, CVE-2020-14553, CVE-2020-14623

Security-In-Depth Contributors

In this Critical Patch Update, Oracle recognizes the following for contributions to Oracle’s Security-In-Depth program.:

Alexander Kornbrust of Red Database Security [10 reports]
Cao Linhong of Sangfor Furthereye Security Team
Chi Tran [2 reports]
Fatih Çelik
James Nichols of 80/20 Labs
lufei of Tencent Force
Maoxin Lin of Dbappsecurity Team
Marc Fielding of Google
Markus Loewe [2 reports]
r00t4dm from A-TEAM of Legendsec at Qi’anxin Group
Ryan Gerstenkorn
Saeid Tizpaz Niari
Shimizu Kawasaki of Asiainfo-sec of CSS Group
Trung Le [2 reports]
Venustech ADLab
Yu Wang of BMH Security Team [2 reports]

On-Line Presence Security Contributors

For this quarter, Oracle recognizes the following for contributions to Oracle’s On-Line Presence Security program:

0xd0ff9 aka Bao Bui
1ZRR4H aka Germán Fernández
@ngkogkos hunt4p1zza
Abdulkadir Mutlu
Abdullah Mohamed
Abhinav P
Aditra Andri Laksana
Ahmed Moustafa
Alfie Njeru (emenalf)
Aman Deep Singh Chawla
Anas Rahmani
Anat Bremler-Barr
Anis Azzi
Anon Venus
Ansar Uddin Anan
Ben Passmore
Celal Erdik of Ebruu Tech Limited
Chirag Prajapati
Dave Altena
Dhamu Harker
Dhiral Patel
Dhiren Kumar Pradhan
Elmonzer Kamaleldin of Monzer Kamal
HackersEra VMS [2 reports]
Hamza Megahed
Harpreet Singh of Pyramid Cyber Security & Forensic Pvt Ltd
Harry The DevOps Guy
Ilyas Orak
Jagdish Bharucha
Jatin Saini
Jeremy Lindsey of Burns & McDonnell [2 reports]
Jin DanLong
Josue Acevedo Maldonado
Ken Nevers
Kishore Hariram [2 reports]
Last Light [2 reports]
Lior Shafir
Luciano Anezin
Maayan Amid of Orca Security
Magrabur Alam Sofily
Matthijs R. Koot [2 reports]
Mayur Gupta
Meridian Miftari
Moaied Nagi Hassan (Moonlight)
Mohit Khemchandani
Muhammad Abdullah
Naveen Kumar
Ome Mishra
Prathmesh Lalingkar
Pratish Bhansali
Prince Achillies
Pritam Mukherjee
Rajesh Patil
Raphael Karger
Ricardo Iramar dos Santos
Ridvan Erbas
Roger Meyer
rootme34
Russell Muetzelfeldt of Flybuys
Saad Zitouni
Sajid Ali
Sam Jadali
Sarath Kumar (Kadavul)
Saurabh Dilip Mhatre
Severus of VietSunshine Security Engineering Team
Shailesh Kumar
Shubham Khadgi
Sipke Mellema
Siva Pathela
Smii Mondher
Srinivas M
Tinu Tomy
Tony Marcel Nasr [2 reports]
Tuatnh
Tushar Bhardwaj
Ujjwal Tyagi
Valentin Virtejanu of Lifespan
Victor Gevers
Viet Nguyen [2 reports]
Virendra Tiwari
Vishal Ajwani
Vlad Staricin
Yehuda Afek
Youssef A. Mohamed aka GeneralEG
Zubin

Critical Patch Update Schedule

Critical Patch Updates are released on the Tuesday closest to the 17th day of January, April, July and October. The next four dates are:

20 October 2020
19 January 2021
20 April 2021
20 July 2021

References

Modification History

Date	Note
2020-December-1	Rev 8. Updated CVSS score of CVE-2020-14564.
2020-August-31	Rev 7. Credit Statement Update.
2020-August-3	Rev 6. Credit Statement Update.
2020-July-27	Rev 5. Credit Statement Update.
2020-July-24	Rev 4. Affected version number changes to CVE-2020-14701 & CVE-2020-14606
2020-July-23	Rev 3. Added entry for CVE-2020-14725 in MySQL Risk Matrix. The fix was included in patches already released but was inadvertently not documented.
2020-July-20	Rev 2. Credit Statement Update.
2020-July-14	Rev 1. Initial Release.

Oracle Database Products Risk Matrices

This Critical Patch Update contains 27 new security patches for the Oracle Database Products divided as follows:

19 new security patches for Oracle Database Server.
3 new security patches for Oracle Berkeley DB.
1 new security patch for Oracle Global Lifecycle Management.
3 new security patches for Oracle GoldenGate.
1 new security patch for Oracle TimesTen In-Memory Database.

Oracle Database Server Risk Matrix

This Critical Patch Update contains 19 new security patches for the Oracle Database Server. 1 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. None of these patches are applicable to client-only installations, i.e., installations that do not have the Oracle Database Server installed. The English text form of this Risk Matrix can be found here.

CVE#	Component	Package and/or Privilege Required	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Component	Package and/or Privilege Required	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2016-1000031	MapViewer (Apache Commons FileUpload)	Valid User Account	HTTP	No	8.8	Network	Low	Low	None	Un- changed	High	High	High	12.2.0.1, 18c, 19c	See Note 1
CVE-2020-2968	Java VM	Create Session, Create Procedure	Multiple	No	8.0	Network	High	Low	Required	Changed	High	High	High	11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, 19c
CVE-2016-9843	Core RDBMS (zlib)	Create Session	Oracle Net	No	7.2	Network	Low	High	None	Un- changed	High	High	High	18c
CVE-2020-2969	Data Pump	DBA role account	Oracle Net	No	6.6	Network	High	High	None	Un- changed	High	High	High	11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, 19c
CVE-2020-8112	GeoRaster (OpenJPG)	Create Session	Oracle Net	No	5.7	Network	Low	Low	Required	Un- changed	None	None	High	18c
CVE-2020-2513	Oracle Application Express	SQL Workshop	HTTP	No	5.4	Network	Low	Low	Required	Changed	Low	Low	None	5.1-19.2
CVE-2020-2971	Oracle Application Express	SQL Workshop	HTTP	No	5.4	Network	Low	Low	Required	Changed	Low	Low	None	5.1-19.2
CVE-2020-2972	Oracle Application Express	SQL Workshop	HTTP	No	5.4	Network	Low	Low	Required	Changed	Low	Low	None	5.1-19.2
CVE-2020-2973	Oracle Application Express	SQL Workshop	HTTP	No	5.4	Network	Low	Low	Required	Changed	Low	Low	None	5.1-19.2
CVE-2020-2974	Oracle Application Express	SQL Workshop	HTTP	No	5.4	Network	Low	Low	Required	Changed	Low	Low	None	5.1-19.2
CVE-2020-2976	Oracle Application Express	SQL Workshop	HTTP	No	5.4	Network	Low	Low	Required	Changed	Low	Low	None	5.1-19.2
CVE-2020-2975	Oracle Application Express	SQL Workshop	HTTP	No	5.4	Network	Low	Low	Required	Changed	Low	Low	None	5.1-19.2
CVE-2019-17569	Workload Manager (Apache Tomcat)	None	HTTP	Yes	4.8	Network	High	None	None	Un- changed	Low	Low	None	12.2.0.1, 18c, 19c
CVE-2020-2977	Oracle Application Express	Valid User Account	HTTP	No	4.6	Network	Low	Low	Required	Un- changed	Low	Low	None	5.1-19.2
CVE-2020-2978	Oracle Database – Enterprise Edition	DBA role account	Oracle Net	No	4.1	Network	Low	High	None	Changed	None	Low	None	12.1.0.2, 12.2.0.1, 18c, 19c
CVE-2019-13990	MapViewer (Terracotta Quartz Scheduler, Apache Batik, Google Guava)	Local Logon	None	No	0.0	Local	Low	Low	Required	Un- changed	None	None	None	12.2.0.1, 18c, 19c	See Note 2
CVE-2018-18314	Oracle Database (Perl)	Local Logon	None	No	0.0	Local	High	High	None	Un- changed	None	None	None	11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, 19c	See Note 3
CVE-2019-10086	Spatial Studio (Apache Commons Beanutils)	Local Logon	None	No	0.0	Local	Low	Low	None	Un- changed	None	None	None	Spatial Studio: Prior to 19.2.1	See Note 4
CVE-2019-16943	TFA (jackson-databind)	Local Logon	None	No	0.0	Local	High	High	None	Un- changed	None	None	None	12.2.0.1, 18c, 19c	See Note 5

Notes:

MapViewer is not deployed with a default installation. To use MapViewer the customer needs to re-deploy MapViewer EAR file into Oracle WebLogic Server.
The CVE-2019-13990 and other CVEs listed for this patch are not exploitable in the context of Oracle Spatial and Graph MapViewer product, thus the CVSS score is 0.0.
None of the CVEs listed against this row are exploitable in the context of Oracle Database, thus the CVSS score is 0.0.
The CVE-2019-10086 is not exploitable in the context of Oracle Spatial Studio product, thus the CVSS score is 0.0.
The CVE-2019-16943 and additional CVEs addressed by this patch are not exploitable in the context of Oracle TFA, thus the CVSS score for TFA patch for this issue is is 0.0.

Additional CVEs addressed are below:

The patch for CVE-2016-9843 also addresses CVE-2016-9840, CVE-2016-9841 and CVE-2016-9842.
The patch for CVE-2018-18314 also addresses CVE-2015-8607, CVE-2015-8608, CVE-2016-2381, CVE-2017-12814, CVE-2017-12837, CVE-2017-12883, CVE-2018-12015, CVE-2018-18311, CVE-2018-18312, CVE-2018-18313, CVE-2018-6797, CVE-2018-6798 and CVE-2018-6913.
The patch for CVE-2019-13990 also addresses CVE-2018-10237 and CVE-2018-8013.
The patch for CVE-2019-16943 also addresses CVE-2019-16942 and CVE-2019-17531.
The patch for CVE-2019-17569 also addresses CVE-2020-1935 and CVE-2020-1938.
The patch for CVE-2020-8112 also addresses CVE-2016-1923, CVE-2016-1924, CVE-2016-3183, CVE-2016-4796, CVE-2016-4797, CVE-2016-8332, CVE-2016-9112 and CVE-2020-6851.

Oracle Berkeley DB Risk Matrix

This Critical Patch Update contains 3 new security patches for Oracle Berkeley DB. None of these vulnerabilities may be remotely exploitable without authentication, i.e., none may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Component	Package and/or Privilege Required	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Component	Package and/or Privilege Required	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2017-10140	Data Store	None	None	No	7.3	Local	Low	Low	Required	Un- changed	High	High	High	Prior to 6.1.38
CVE-2020-2981	Data Store	None	None	No	7.0	Local	High	None	Required	Un- changed	High	High	High	Prior to 18.1.40
CVE-2019-8457	Data Store (SQLite)	None	TCP	No	0.0	Network	Low	None	Required	Un- changed	None	None	None	Prior to 18.1.40	See Note 1

Notes:

The CVE-2019-8457 is not exploitable in the context of Oracle Berkeley DB product, thus the CVSS score is 0.0.

Oracle Global Lifecycle Management Risk Matrix

This Critical Patch Update contains 1 new security patch for Oracle Global Lifecycle Management. This vulnerability is not remotely exploitable without authentication, i.e., may not be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-9546	Oracle Global Lifecycle Management/OPatch	Patch Installer (jackson-databind)	None	No	0.0	Local	Low	Low	None	Un- changed	None	None	None	Prior to 12.2.0.1.20	See Note 1

Notes:

None of the CVEs listed against this row are exploitable in the Oracle Global Lifecycle Management product, thus the CVSS score is 0.0.

Additional CVEs addressed are below:

The patch for CVE-2020-9546 also addresses CVE-2019-16943, CVE-2020-10650, CVE-2020-10672, CVE-2020-10673, CVE-2020-10968, CVE-2020-10969, CVE-2020-11111, CVE-2020-11112, CVE-2020-11113, CVE-2020-11619, CVE-2020-11620, CVE-2020-9547 and CVE-2020-9548.

Oracle GoldenGate Risk Matrix

This Critical Patch Update contains 3 new security patches for Oracle GoldenGate. 1 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-14705	Oracle GoldenGate	Process Management	TCP	Yes	9.6	Adjacent Network	Low	None	None	Changed	High	High	High	Prior to 19.1.0.0.0
CVE-2019-0222	GoldenGate Stream Analytics	Security (ActiveMQ)	TCP	No	6.5	Network	Low	Low	None	Un- changed	None	None	High	Prior to 19.1.0.0.1
CVE-2019-14379	GoldenGate Stream Analytics	Security / Application Adapters (jackson-databind, SLF4J, ZooKeeper, Apache Spark)	None	No	0.0	Local	Low	Low	None	Un- changed	None	None	None	Prior to 19.1.0.0.1	See Note 1

Notes:

CVE-2019-14379 and other CVEs addressed by these patches are not exploitable in the Oracle GoldenGate product, thus the CVSS score is 0.0.

Additional CVEs addressed are below:

The patch for CVE-2019-14379 also addresses CVE-2016-5017, CVE-2017-5637, CVE-2018-17190, CVE-2018-8012, CVE-2018-8088, CVE-2019-0201, CVE-2019-12086, CVE-2019-12384, CVE-2019-12814, CVE-2019-14439 and CVE-2019-14893.

Oracle TimesTen In-Memory Database Risk Matrix

This Critical Patch Update contains 1 new security patch for Oracle TimesTen In-Memory Database. This vulnerability is not remotely exploitable without authentication, i.e., may not be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2018-18314	Oracle TimesTen In-Memory Database	Doc, EM Plug-in (Perl)	OracleNet	No	0.0	Network	Low	Low	None	Un- changed	None	None	None	Prior to 18.1.2.1.0	See Note 1

Notes:

None of the CVEs listed against this row are exploitable in the context of Oracle Database, thus the CVSS score is 0.0.

Additional CVEs addressed are below:

The patch for CVE-2018-18314 also addresses CVE-2015-8607, CVE-2015-8608, CVE-2016-2381, CVE-2017-12814, CVE-2017-12837, CVE-2017-12883, CVE-2018-12015, CVE-2018-18311, CVE-2018-18312, CVE-2018-18313, CVE-2018-6797, CVE-2018-6798 and CVE-2018-6913.

Oracle Commerce Risk Matrix

This Critical Patch Update contains 4 new security patches for Oracle Commerce. 3 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-14536	Oracle Commerce Guided Search / Oracle Commerce Experience Manager	Workbench	HTTP	Yes	7.4	Network	High	None	None	Un- changed	High	High	None	11.0, 11.1, 11.2, prior to 11.3.1
CVE-2020-14535	Oracle Commerce Service Center	Commerce Service Center	HTTP	Yes	7.4	Network	High	None	None	Un- changed	High	High	None	11.1, 11.2, prior to 11.3.1
CVE-2020-14532	Oracle Commerce Platform	Dynamo Application Framework	HTTP	Yes	4.7	Network	Low	None	Required	Changed	None	Low	None	11.1, 11.2, prior to 11.3.1
CVE-2020-14533	Oracle Commerce Platform	Dynamo Application Framework	HTTP	No	3.5	Network	Low	High	Required	Un- changed	Low	Low	None	11.1, 11.2, prior to 11.3.1

Oracle Communications Applications Risk Matrix

This Critical Patch Update contains 60 new security patches for Oracle Communications Applications. 46 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	CVSS VERSION 3.1 RISK (see Risk Matrix Definitions)									Supported Versions Affected	Notes
CVE#	Product	Component	Protocol	Remote Exploit without Auth.?	Base Score	Attack Vector	Attack Complex	Privs Req’d	User Interact	Scope	Confid- entiality	Inte- grity	Avail- ability	Supported Versions Affected	Notes
CVE-2020-14701	Oracle SD-WAN Aware	User Interface	HTTP	Yes	10.0	Network	Low	None	None	Changed	High	High	High	8.0, 8.1, 8.2
CVE-2020-14606	Oracle SD-WAN Edge	User Interface	HTTP	Yes	10.0	Network	Low	None	None	Changed	High	High	High	8.0, 8.1, 8.2, 9.0
CVE-2018-11058	Oracle Communications Analytics	Platform (RSA BSAFE)	Multiple	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	12.1.1
CVE-2019-16943	Oracle Communications Billing and Revenue Management	Business Operation Center, Billing Care (jackson-databind)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	7.5.0.23.0, 12.0.0.3.0
CVE-2016-1000031	Oracle Communications Contacts Server	Core (Apache Commons FileUpload)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	8.0.0.4.0
CVE-2020-9546	Oracle Communications Contacts Server	Core (jackson-databind)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	8.0.0.4.0
CVE-2020-1938	Oracle Communications Element Manager	Core (Apache Tomcat)	Apache JServ Protocol (AJP)	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	8.1.1, 8.2.0, 8.2.1
CVE-2020-9546	Oracle Communications Evolved Communications Application Server	Session Design Center, Universal Data Recorder (jackson-databind)	Multiple	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	7.1
CVE-2020-1938	Oracle Communications Instant Messaging Server	Installation (Apache Tomcat)	Apache JServ Protocol (AJP)	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	10.0.1.4.0
CVE-2020-9546	Oracle Communications Instant Messaging Server	Presence API (jackson-databind)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	10.0.1.4.0
CVE-2019-13990	Oracle Communications IP Service Activator	Netwok Processor Configuration Management (Terracotta Quartz Scheduler)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	7.3.0, 7.4.0
CVE-2020-11656	Oracle Communications Network Charging and Control	Data Access Pack (SQLite)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	6.0.1, 12.0.0-12.0.3
CVE-2019-2729	Oracle Communications Network Integrity	Integration (Oracle WebLogic Server)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	7.3.2-7.3.6
CVE-2019-2904	Oracle Communications Network Integrity	User Interface (Application Development Framework)	HTTP	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	7.3.2-7.3.6
CVE-2017-5645	Oracle Communications Network Integrity	Cartridge Management (Log4j)	Multiple	Yes	9.8	Network	Low	None	None	Un- changed	High	High	High	7.3.2-7.3.6
CVE-2020-7060	Oracle Communications Diameter Signaling Router (DSR)	Platform (PHP)	HTTP	Yes	9.1	Network	Low	None	None	Un- changed	High	None	High	8.0-8.4
CVE-2020-1945	Oracle Communications MetaSolv Solution	Online Help (Apache Ant)	HTTP	Yes	9.1	Network	Low	None	None	Un- changed	High	High	None	6.3.0
CVE-2018-1258	Oracle Communications Network Integrity	Core (Spring Framework)	HTTP	No	8.8	Network	Low	Low	None	Un- changed	High	High	High	7.3.2-7.3.6
CVE-2020-9546	Oracle Communications Network Charging and Control	Installer (jackson-databind)	None	No	8.4	Local	Low	None	None	Un- changed	High	High	High	6.0.1, 12.0.0-12.0.3
CVE-2020-14580	Oracle Communications Session Border Controller	System Admin	SSH	No	8.2	Network	Low	Low	Required	Changed	High	Low	Low	8.1.0, 8.2.0, 8.3.0
CVE-2016-1181	Oracle Communications Network Integrity	MSS Integration Cartridge (Apache Struts 1)	HTTP	Yes	8.1	Network	High	None	None	Un- changed	High	High	High	7.3.2-7.3.6
CVE-2017-0861	Oracle Communications LSMS	Kernel	None	No	7.8	Local	Low	Low	None	Un- changed	High	High	High	13.0-13.3
CVE-2020-1945	Oracle Communications Order and Service Management	Installer (Apache Ant)	None	No	7.7	Local	Low	None	None	Un- changed	High	High	None	7.3, 7.4
CVE-2020-5398	Oracle Communications BRM – Elastic Charging Engine	Orchestration (Spring Framework)	HTTP	Yes	7.5	Network	High	None	Required	Un- changed	High	High	High	11.3, 12.0
CVE-2019-17359	Oracle Communications Convergence	S/MIME Configuration (Bouncy Castle Java Library)	HTTPS	Yes	7.5	Network	Low	None	None	Un- changed	None	None	High	3.0.1.0-3.0.2.1
CVE-2020-5398	Oracle Communications Element Manager	Core (Spring Framework)	HTTP	Yes	7.5	Network	High	None	Required	Un- changed	High	High	High	8.1.1, 8.2.0, 8.2.1
CVE-2019-0227	Oracle Communications Network Integrity	Adapters (Apache Axis)	HTTP	Yes	7.5	Adjacent Network	High	None	None	Un- changed	High	High	High	7.3.5, 7.3.6
CVE-2019-16056	Oracle Communications Operations Monitor	VSP implementing webserver (Python)	HTTP	Yes	7.5	Network	Low	None	None	Un- changed	High	None	None	3.4, 4.1-4.3
CVE-2019-0227	Oracle Communications Order and Service Management	Installer, CMWS, CMT (Apache Axis)	HTTP	Yes	7.5	Adjacent Network	High	None	None	Un- changed	High	High	High	7.3, 7.4
CVE-2020-5398	Oracle Communications Session Report Manager	Core (Spring Framework)	HTTP	Yes	7.5	Network	High	None	Required	Un- changed	High	High	High	8.1.1, 8.2.0, 8.2.1
CVE-2020-5398	Oracle Communications Session Route Manager	Core (Spring Framework)	HTTP	Yes	7.5	Network	High	None	Required	Un- changed	High	High	High	8.1.1, 8.2.0, 8.2.1
CVE-2020-14630	Oracle Enterprise Session Border Controller	File Upload	HTTP	No	7.5	Network	Low	High	Required	Changed	Low	Low	High	8.1.0, 8.2.0, 8.3.0
CVE-2019-10193	Oracle Communications Operations Monitor	FDP, VSP Login, Packet Inspector (Redis)	HTTP	No	7.2	Network	Low	High	None	Un- changed	High	High	High	3.4, 4.1
CVE-2019-12423	Oracle Communications Element Manager	REST API (Apache CXF)	HTTP	No	6.5	Network	Low	Low	None	Un- changed	High	None	None	8.1.1, 8.2.0, 8.2.1
CVE-2019-12423	Oracle Communications Session Report Manager	REST API (Apache CXF)	HTTP	No	6.5	Network	Low	Low	None	Un- changed	High	None	None	8.1.1, 8.2.0, 8.2.1
CVE-2019-12423	Oracle Communications Session Route Manager	REST API (Apache CXF)	HTTP	No	6.5	Network	Low	Low	None	Un- changed	High	None	None	8.1.1, 8.2.0, 8.2.1
CVE-2020-14721	Oracle Enterprise Communications Broker	WebGUI	HTTP	No	6.3	Network	Low	Low	None	Un- changed	Low	Low	Low	3.0.0-3.2.0
CVE-2020-11022	Oracle Communications Analytics	Platform (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	12.1.1
CVE-2020-11022	Oracle Communications Element Manager	User Interface (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.1.1, 8.2.0, 8.2.1
CVE-2020-1941	Oracle Communications Element Manager	Workorders (Apache ActiveMQ)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.1.1, 8.2.0, 8.2.1
CVE-2020-11022	Oracle Communications Interactive Session Recorder	Dashboard (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	6.1-6.4
CVE-2019-17091	Oracle Communications Network Integrity	Core (Eclipse Mojarra)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	7.3.5, 7.3.6
CVE-2020-11022	Oracle Communications Operations Monitor	Mediation Engine, Dashboard, Grapahs, Calls (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	3.4, 4.1-4.3
CVE-2020-11022	Oracle Communications Session Report Manager	User Interface (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.1.1, 8.2.0, 8.2.1
CVE-2020-1941	Oracle Communications Session Report Manager	Workorders (Apache ActiveMQ)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.1.1, 8.2.0, 8.2.1
CVE-2020-11022	Oracle Communications Session Route Manager	User Interface (jQuery)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.1.1, 8.2.0, 8.2.1
CVE-2020-1941	Oracle Communications Session Route Manager	Workorders (Apache ActiveMQ)	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	8.1.1, 8.2.0, 8.2.1
CVE-2020-14563	Oracle Enterprise Communications Broker	WebGUI	HTTP	Yes	6.1	Network	Low	None	Required	Changed	Low	Low	None	3.0.0-3.2.0
CVE-2020-14722	Oracle Enterprise Communications Broker	WebGUI	HTTP	Yes	5.8	Network	High	None	Required	Changed	Low	Low	Low	3.0.0-3.2.0
CVE-2018-3639	Oracle Communications LSMS	Kernel	None	No	5.5	Local	Low	Low	None	Un- changed	High	None	None	13.0-13.3
CVE-2020-1951	Oracle Communications Messaging Server	Security (Apache Tika)	None	No	5.5	Local	Low	None	Required	Un- changed	None	None	High	8.0.2, 8.1.0
CVE-2019-10247	Oracle Communications Analytics	Platform (Eclipse Jetty)	HTTP	Yes	5.3	Network	Low	None	None	Un- changed	Low	None	None	12.1.1
CVE-2020-1934	Oracle Communications Element Manager	Core (Apache HTTP Server)	HTTP	Yes	5.3	Network	Low	None	None	Un- changed	Low	None	None	8.1.1, 8.2.0, 8.2.1
CVE-2019-10247	Oracle Communications Services Gatekeeper	Platform Test Environment (Eclipse Jetty)	HTTP	Yes	5.3	Network	Low	None	None	Un- changed	Low	None	None	6.0, 6.1, 7.0
CVE-2020-1934	Oracle Communications Session Report Manager	Core (Apache HTTP Server)	HTTP	Yes	5.3	Network	Low	None	None	Un- changed	Low	None	None	8.1.1, 8.2.0, 8.2.1
CVE-2020-1934	Oracle Communications Session Route Manager	Core (Apache HTTP Server)	HTTP	Yes	5.3	Network	Low	None	None	Un- changed	Low	None	None	8.1.1, 8.2.0, 8.2.1
CVE-2020-14574	Oracle Communications Interactive Session Recorder	FACE	None	No	4.7	Local	High	High	None	Un- changed	High	Low	None	6.1-6.4
CVE-2020-9488	Oracle Communications Instant Messaging Server	Installation (Log4j)	SMTPS	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	10.0.1.4.0
CVE-2020-9488	Oracle Communications Interactive Session Recorder	API, FACE, Archiver (Log4j)	SMTPS	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	6.1-6.4
CVE-2020-9488	Oracle Communications Network Charging and Control	Notification Gateway (Log4j)	SMTPS	Yes	3.7	Network	High	None	None	Un- changed	Low	None	None	6.0.1, 12.0.0-12.0.3

Additional CVEs addressed are below:

The patch for CVE-2016-1181 also addresses CVE-2016-1182.
The patch for CVE-2017-0861 also addresses CVE-2017-15265, CVE-2018-1000004, CVE-2018-10901, CVE-2018-3620, CVE-2018-3646, CVE-2018-3693, CVE-2018-5390 and CVE-2018-7566.
The patch for CVE-2017-5645 also addresses CVE-2020-9488.
The patch for CVE

Oracle Critical Patch Update Advisory – July 2021

Description

Affected Products and Patch Information

Note:

Risk Matrix Content

Workarounds

Skipped Critical Patch Updates

Critical Patch Update Supported Products and Versions

Credit Statement

Security-In-Depth Contributors

On-Line Presence Security Contributors

Critical Patch Update Schedule

References

Modification History

Oracle Database Products Risk Matrices

Oracle Database Server Risk Matrix

Notes:

Additional patches are included in this Critical Patch Update for the following non-exploitable CVEs in this Oracle product family:

Oracle Database Server Client-Only Installations

Oracle Big Data Graph Risk Matrix

Additional CVEs addressed are:

Additional patches are included in this Critical Patch Update for the following non-exploitable CVEs in this Oracle product family:

Oracle Essbase Risk Matrix

Additional CVEs addressed are:

Oracle Commerce Risk Matrix

Additional CVEs addressed are:

Oracle Communications Applications Risk Matrix

Additional CVEs addressed are:

Oracle Communications Risk Matrix

Additional CVEs addressed are:

Oracle Construction and Engineering Risk Matrix

Additional CVEs addressed are:

Oracle E-Business Suite Risk Matrix

Oracle Enterprise Manager Risk Matrix

Additional CVEs addressed are:

Oracle Financial Services Applications Risk Matrix

Additional CVEs addressed are:

Oracle Food and Beverage Applications Risk Matrix

Oracle Fusion Middleware Risk Matrix

Notes:

Additional CVEs addressed are:

Oracle Hospitality Applications Risk Matrix

Oracle Hyperion Risk Matrix

Additional CVEs addressed are:

Oracle Insurance Applications Risk Matrix

Additional CVEs addressed are:

Oracle Java SE Risk Matrix

Notes:

Oracle JD Edwards Risk Matrix

Additional CVEs addressed are:

Oracle MySQL Risk Matrix

Additional CVEs addressed are:

Oracle PeopleSoft Risk Matrix

Additional CVEs addressed are:

Oracle Policy Automation Risk Matrix

Oracle Retail Applications Risk Matrix

Additional CVEs addressed are:

Oracle Siebel CRM Risk Matrix

Additional CVEs addressed are:

Oracle Supply Chain Risk Matrix

Additional CVEs addressed are:

Oracle Support Tools Risk Matrix

Additional CVEs addressed are:

Oracle Systems Risk Matrix

Additional CVEs addressed are:

Oracle Virtualization Risk Matrix

Notes:

Related:

Oracle Critical Patch Update Advisory – April 2021

Description

Affected Products and Patch Information

Note:

Risk Matrix Content

Workarounds

Skipped Critical Patch Updates

Critical Patch Update Supported Products and Versions

Credit Statement

Security-In-Depth Contributors

On-Line Presence Security Contributors

Critical Patch Update Schedule