Graham Rymer

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.1.3 and 12.2.3 through 12.2.10 Description: The issue is related to insufficient input validation in the Diagnostics component of the Oracle Application Object Library. It allows an unauthenticated attacker with network access via HTTP to compromise the Oracle Application Object Library, requiring human interaction from a person other than the attacker. Successful attacks can result in unauthorized update, insert, or delete access to some of the Oracle Application Object Library's accessible data, potentially impacting additional products. Recommendations: For versions 12.1.3 and 12.2.3 through 12.2.10, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: FasterXML jackson-databind versions 2.0.0 through 2.9.10.2 FasterXML jackson-databind 2.x before 2.6.7.4 FasterXML jackson-databind 2.7.x before 2.7.9.7 FasterXML jackson-databind 2.8.x before 2.8.11.5 FasterXML jackson-databind 2.9.x before 2.9.10.2 Description: The issue is related to the xbean-reflect/JNDI component of the Jackson-databind library, which lacks certain blocking, as demonstrated by `org.apache.xbean.propertyeditor.JndiConverter`. This can allow a remote attacker to access confidential data, compromise data integrity, and cause a denial of service by exploiting the vulnerability, which is associated with the restoration of untrusted data structures in memory. Recommendations: For FasterXML jackson-databind versions 2.0.0 through 2.9.10.2, update to a version that includes the necessary xbean-reflect/JNDI blocking. For FasterXML jackson-databind 2.x before 2.6.7.4, update to version 2.6.7.4 or later. For FasterXML jackson-databind 2.7.x before 2.7.9.7, update to version 2.7.9.7 or later. For FasterXML jackson-databind 2.8.x before 2.8.11.5, update to version 2.8.11.5 or later. For FasterXML jackson-databind 2.9.x before 2.9.10.2, update to version 2.9.10.2 or later. As a temporary workaround, consider disabling the `org.apache.xbean.propertyeditor.JndiConverter` class until a patch is available.