Oracle April 2020 Critical Patch Update for All Product Families Threat Alert

Oracle April 2020 Critical Patch Update for All Product Families Threat Alert

abril 26, 2020 | Adeline Zhang

Overview

On April 14, 2020, local time, Oracle released its own security advisory and third-party security advisories for its April 2020 Critical Patch Update (CPU) which fix 397 vulnerabilities of varying severity levels across the product families. For details about affected products and available patches, visit the following link:

https://www.oracle.com/security-alerts/cpuapr2020.html

Fixed Vulnerabilities

Product Number of Vulnerabilities Number of Remote Exploits Without Auth. CVSS Base Score
Oracle Database server 8 2 8.0
Oracle Global Lifecycle Management 1 0 0
Oracle Secure Backup 1 1 6.1
Oracle Communications Applications 39 35 9.8
Oracle Construction and Engineering 12 9 9.8
Oracle E-Business Suite 74 70 8.6
Oracle Enterprise Manager 7 5 9.8
Oracle Financial Services Applications 35 16 9.8
Oracle Food and Beverage Applications 1 0 8.1
Oracle Fusion Middleware 51 44 9.8
Oracle GraalVM 5 2 9.8
Oracle Health Sciences Applications 2 2 6.1
Oracle Hyperion 3 0 4.2
Oracle Java SE 15 15 8.3
Oracle JD Edwards 4 2 9.8
Oracle Knowledge 16 15 9.8
Oracle MySQL 45 9 9.8
Oracle PeopleSoft 14 10 8.6
Oracle Retail Applications 27 17 9.8
Oracle Siebel CRM 1 0 4.3
Oracle Supply Chain 4 3 9.8
Oracle Support Tools 2 2 9.8
Oracle Systems 9 2 9.8
Oracle Utilities Applications 2 2 7.5
Oracle Virtualization 19 1 8.8

Affected Products and Versions

For details, see the appendix.

Critical Patch Update

A Critical Patch Update is a collection of patches for multiple security vulnerabilities. Critical Patch Update patches are usually cumulative, but each advisory describes only the security fixes added since the previous Critical Patch Update advisory. Thus, prior Critical Patch Update advisories should be reviewed for information regarding earlier published security fixes.

Solution

Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply Critical Patch Update fixes as soon as possible.

Appendix

The following table lists affected products (and their versions) and related patches.

Affected Products and Versions Patch Availability Document
Application Performance Management, versions 12.1.0.5, 13.2.0.0, 13.3.0.0 Enterprise Manager
Application Service Level Management, versions 13.2.0.0, 13.3.0.0 Enterprise Manager
Enterprise Manager Base Platform, versions 12.1.0.5, 13.2.0.0, 13.3.0.0 Enterprise Manager
Hyperion Financial Management, version 11.1.2.4 Fusion Middleware
Hyperion Financial Reporting, version 11.1.2.4 Fusion Middleware
Identity Manager Connector, version 9.0 Fusion Middleware
Instantis EnterpriseTrack, versions 17.1-17.3 Oracle Construction and Engineering Suite
Java Advanced Management Console, version 2.16 Java SE
JD Edwards EnterpriseOne Tools, version 9.2 JD Edwards
JD Edwards World Security, versions A9.3, A9.3.1, A9.4 JD Edwards
MICROS Relate CRM Software, version 11.4 Retail Applications
MySQL Client, versions 5.6.47 and prior, 5.7.29 and prior, 8.0.18 and prior MySQL
MySQL Cluster, versions 7.3.28 and prior, 7.4.27 and prior, 7.5.17 and prior, 7.6.13 and prior, 8.0.19 and prior MySQL
MySQL Connectors, versions 5.1.48 and prior, 8.0.19 and prior MySQL
MySQL Enterprise Monitor, versions 4.0.11.5331 and prior, 8.0.18.1217 and prior MySQL
MySQL Server, versions 5.6.47 and prior, 5.7.29 and prior, 8.0.19 and prior MySQL
MySQL Workbench, versions 8.0.19 and prior MySQL
Oracle Access Manager, versions 11.1.2.3.0, 12.2.1.3.0 Fusion Middleware
Oracle Agile PLM, versions 9.3.3, 9.3.5, 9.3.6 Oracle Supply Chain Products
Oracle API Gateway, version 11.1.2.4.0 Fusion Middleware
Oracle Application Express, versions prior to 19.2 Database
Oracle Application Testing Suite, versions 13.2.0.1, 13.3.0.1 Enterprise Manager
Oracle Banking Enterprise Collections, versions 2.7.0, 2.8.0 Oracle Banking Platform
Oracle Banking Enterprise Originations, versions 2.7.0, 2.8.0 Oracle Banking Platform
Oracle Banking Enterprise Product Manufacturing, versions 2.7.0, 2.8.0 Oracle Banking Platform
Oracle Banking Platform, versions 2.4.0, 2.4.1, 2.5.0, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, 2.9.0 Oracle Banking Platform
Oracle Big Data Discovery, version 1.6 Fusion Middleware
Oracle Business Intelligence Enterprise Edition, versions 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0 Fusion Middleware
Oracle Business Process Management Suite, version 12.2.1.4.0 Fusion Middleware
Oracle Coherence, versions 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 Fusion Middleware
Oracle Communications ASAP Cartridges, versions 7.2, 7.3 Oracle Communications ASAP Cartridges
Oracle Communications Calendar Server, versions 8.0.0.2.0, 8.0.0.3.0 Oracle Communications Calendar Server
Oracle Communications Converged Application Server – Service Controller, version 6.1 Oracle Communications Converged Application Server – Service Controller
Oracle Communications Diameter Signaling Router (DSR), versions 8.0.0, 8.1.0, 8.2.0, 8.2.1 Oracle Communications Diameter Signaling Router
Oracle Communications Element Manager, versions 8.0.0, 8.1.0, 8.1.1, 8.2.0 Oracle Communications Element Manager
Oracle Communications Evolved Communications Application Server, version 7.1 Oracle Communications Evolved Communications Application Server
Oracle Communications Messaging Server, versions 8.0.2, 8.1.0 Oracle Communications Messaging Server
Oracle Communications Operations Monitor, versions 3.4.0, 4.0.0, 4.1.0, 4.2.0, 4.3.0 Oracle Communications Operations Monitor
Oracle Communications Service Broker, versions 6.0, 6.1 Oracle Communications Service Broker
Oracle Communications Services Gatekeeper, versions 6.0, 6.1 Oracle Communications Services Gatekeeper
Oracle Communications Session Report Manager, versions 8.0.0, 8.1.0, 8.1.1, 8.2.0 Oracle Communications Session Report Manager
Oracle Communications Session Route Manager, versions 8.0.0, 8.1.0, 8.1.1, 8.2.0 Oracle Communications Session Route Manager
Oracle Communications Unified Inventory Management, versions 7.3.0, 7.4.0 Oracle Communications Unified Inventory Management
Oracle Communications WebRTC Session Controller, version 7.2 Oracle Communications WebRTC Session Controller
Oracle Configurator, versions 12.1, 12.2 Oracle Supply Chain Products
Oracle Database Server, versions 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, 19c Database
Oracle E-Business Suite, versions 12.1.1-12.1.3, 12.2.3-12.2.9 E-Business Suite
Oracle Endeca Information Discovery Integrator, version 3.2.0 Fusion Middleware
Oracle Endeca Server, version 7.7.0 Fusion Middleware
Oracle Financial Services Analytical Applications Infrastructure, versions 8.0.6-8.0.9 Oracle Financial Services Analytical Applications Infrastructure
Oracle Financial Services Asset Liability Management, versions 8.0.6, 8.0.7 Oracle Financial Services Asset Liability Management
Oracle Financial Services Balance Sheet Planning, version 8.0.8 Oracle Financial Services Balance Sheet Planning
Oracle Financial Services Data Foundation, versions 8.0.6-8.0.9 Oracle Financial Services Data Foundation
Oracle Financial Services Deposit Insurance Calculations for Liquidity Risk Management, versions 8.0.7, 8.0.8 Oracle Financial Services Deposit Insurance Calculations for Liquidity Risk Management
Oracle Financial Services Funds Transfer Pricing, versions 8.0.6, 8.0.7 Oracle Financial Services Funds Transfer Pricing
Oracle Financial Services Hedge Management and IFRS Valuations, versions 8.0.6-8.0.8 Oracle Financial Services Hedge Management and IFRS Valuations
Oracle Financial Services Liquidity Risk Management, version 8.0.6 Oracle Financial Services Liquidity Risk Management
Oracle Financial Services Liquidity Risk Measurement and Management, versions 8.0.7, 8.0.8 Oracle Financial Services Liquidity Risk Measurement and Management
Oracle Financial Services Loan Loss Forecasting and Provisioning, versions 8.0.6-8.0.8 Oracle Financial Services Loan Loss Forecasting and Provisioning
Oracle Financial Services Market Risk Measurement and Management, versions 8.0.6, 8.0.8 Oracle Financial Services Market Risk Measurement and Management
Oracle Financial Services Price Creation and Discovery, version 8.0.7 Oracle Financial Services Price Creation And Discovery
Oracle Financial Services Profitability Management, versions 8.0.6, 8.0.7 Oracle Financial Services Profitability Management
Oracle Financial Services Revenue Management and Billing Analytics, versions 2.6, 2.7, 2.8 Oracle Financial Services Revenue Management and Billing Analytics
Oracle FLEXCUBE Core Banking, version 4.0 Oracle Financial Services Applications
Oracle FLEXCUBE Private Banking, versions 12.0, 12.1 Oracle Financial Services Applications
Oracle Fusion Middleware MapViewer, version 12.2.1.3.0 Fusion Middleware
Oracle Global Lifecycle Management NextGen OUI Framework, versions 12.2.1.3.0, 12.2.1.4.0, 13.9.4.2.2 Fusion Middleware
Oracle Global Lifecycle Management OPatch, versions prior to 11.2.0.3.23, prior to 12.2.0.1.19, prior to 13.9.4.2.1 Global Lifecycle Management
Oracle GraalVM Enterprise Edition, versions 19.3.1, 20.0.0 Oracle GraalVM Enterprise Edition
Oracle Health Sciences Information Manager, version 3.0 Health Sciences
Oracle Healthcare Data Repository, version 7.0 Health Sciences
Oracle Hospitality Reporting and Analytics, version 9.1.0 Oracle Hospitality Reporting and Analytics
Oracle HTTP Server, version 11.1.1.9.0 Fusion Middleware
Oracle In-Memory Performance-Driven Planning, versions 12.1, 12.2 Oracle Supply Chain Products
Oracle Insurance Accounting Analyzer, versions 8.0.6-8.0.9 Oracle Insurance Accounting Analyzer
Oracle Java SE, versions 7u251, 8u241, 11.0.6, 14 Java SE
Oracle Java SE Embedded, version 8u241 Java SE
Oracle Knowledge, versions 8.6.0-8.6.3 Oracle Knowledge
Oracle Managed File Transfer, versions 12.2.1.3.0, 12.2.1.4.0 Fusion Middleware
Oracle Outside In Technology, versions 8.5.4, 8.5.5 Fusion Middleware
Oracle Real User Experience Insight, versions 13.1.2.1, 13.2.3.1, 13.3.1.0 Enterprise Manager
Oracle Retail Advanced Inventory Planning, versions 14.0, 15.0, 16.0 Retail Applications
Oracle Retail Back Office, version 14.1 Retail Applications
Oracle Retail Central Office, version 14.1 Retail Applications
Oracle Retail Customer Management and Segmentation Foundation, version 18.0 Retail Applications
Oracle Retail Merchandising System, version 16.0 Retail Applications
Oracle Retail Order Broker, versions 15.0, 16.0, 18.0, 19.0 Retail Applications
Oracle Retail Point-of-Service, version 14.1 Retail Applications
Oracle Retail Predictive Application Server, versions 15.0.3, 16.0.3 Retail Applications
Oracle Retail Returns Management, version 14.1 Retail Applications
Oracle Retail Store Inventory Management, version 16.0 Retail Applications
Oracle Retail Xstore Point of Service, versions 7.1, 15.0, 16.0, 17.0, 18.0, 18.0.1 Retail Applications
Oracle SD-WAN Edge, versions 7.3, 8.0, 8.1, 8.2 Oracle SD-WAN Edge
Oracle Secure Backup, versions prior to 18.1 Oracle Secure Backup
Oracle SOA Suite, versions 12.2.1.3.0, 12.2.1.4.0 Fusion Middleware
Oracle Solaris, versions 10, 11 Systems
Oracle Transportation Management, versions 6.3.7, 6.4.2, 6.4.3 Oracle Supply Chain Products
Oracle Unified Directory, versions 12.2.1.3.0, 12.2.1.4.0 Fusion Middleware
Oracle Utilities Framework, versions 2.2.0, 4.2.0.2, 4.2.0.3, 4.3.0.2-4.3.0.6, 4.4.0.0, 4.4.0.2 Oracle Utilities Applications
Oracle Utilities Network Management System, versions 1.12.0.3, 2.3.0.1, 2.3.0.2, 2.4.0.0 Oracle Utilities Applications
Oracle VM VirtualBox, versions prior to 5.2.40, prior to 6.0.20, prior to 6.1.6 Virtualization
Oracle WebCenter Portal, versions 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0 Fusion Middleware
Oracle WebCenter Sites, versions 12.2.1.3.0, 12.2.1.4.0 Fusion Middleware
Oracle WebLogic Server, versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 Fusion Middleware
OSS Support Tools, versions 20.0, 20.1 Support Tools
PeopleSoft Enterprise CS Campus Community, version 9.2 PeopleSoft
PeopleSoft Enterprise HCM Absence Management, version 9.2 PeopleSoft
PeopleSoft Enterprise HRMS, version 9.2 PeopleSoft
PeopleSoft Enterprise PeopleTools, versions 8.56, 8.57, 8.58 PeopleSoft
PeopleSoft Enterprise SCM Purchasing, version 9.2 PeopleSoft
Primavera Gateway, versions 16.2.0-16.2.11, 17.12.0-17.12.6, 18.8.0-18.8.8, 19.12.0 Oracle Construction and Engineering Suite
Primavera P6 Enterprise Project Portfolio Management, versions 16.2.0.0-16.2.19.3, 17.12.0.0-17.12.17.0, 18.8.0.0-18.8.18.0, 19.12.1.0-19.12.3.0, 20.1.0.0-20.2.0.0 Oracle Construction and Engineering Suite
Primavera Unifier, versions 16.1, 16.2, 17.7-17.12, 18.8, 19.12 Oracle Construction and Engineering Suite
Siebel Applications, versions 20.2 and prior Siebel
StorageTek Tape Analytics SW Tool, version 2.3.0 Systems
Sun ZFS Storage Appliance Kit, version 8.8 Systems

 

Statement

This advisory is only used to describe a potential risk. NSFOCUS does not provide any commitment or promise on this advisory. NSFOCUS and the author will not bear any liability for any direct and/or indirect consequences and losses caused by transmitting and/or using this advisory. NSFOCUS reserves all the rights to modify and interpret this advisory. Please include this statement paragraph when reproducing or transferring this advisory. Do not modify this advisory, add/delete any information to/from it, or use this advisory for commercial purposes without permission from NSFOCUS.

About NSFOCUS

NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks. The company’s Intelligent Hybrid Security strategy utilizes both cloud and on-premises security platforms, built on a foundation of real-time global threat intelligence, to provide multi-layered, unified and dynamic protection against advanced cyber attacks.

NSFOCUS works with Fortune Global 500 companies, including four of the world’s five largest financial institutions, organizations in insurance, retail, healthcare, critical infrastructure industries as well as government agencies. NSFOCUS has technology and channel partners in more than 60 countries, is a member of both the Microsoft Active Protections Program (MAPP), and the Cloud Security Alliance (CSA).

A wholly owned subsidiary of NSFOCUS Technologies Group Co., Ltd., the company has operations in the Americas, Europe, the Middle East and Asia Pacific.