Oracle July 2021 Critical Patch Update for All Product Families

Overview

On July 21, 2021, NSFOCUS detected that Oracle released the July 2021 Critical Patch Update (CPU), which fixed 342 vulnerabilities of varying risk levels. This CPU involves multiple commonly used products, such as Oracle Database Server, Oracle Java SE, Oracle Fusion Middleware, Oracle MySQL, and Oracle Communications. Oracle strongly recommends that users fix these vulnerabilities by applying Critical Patch Update patches as soon as possible.

Reference link: https://www.oracle.com/security-alerts/cpujul2021.html

Description of Major Vulnerabilities

Based on product popularity and vulnerability importance, we have selected the vulnerabilities with a huge impact from the updates for affected users.

Oracle MySQL multiple vulnerabilities:

This security update contains 41 security patches for Oracle MySQL. Ten of these vulnerabilities may be remotely exploitable without requiring user credentials. The CVE IDs of high-risk vulnerabilities are listed as follows:

• CVE-2021-22884
• CVE-2021-22901

Oracle Communications Applications multiple vulnerabilities:

This security update contains 33 security patches for Oracle Communications Applications. Twenty-two of these vulnerabilities may be remotely exploitable without requiring user credentials. The CVE IDs of high-risk vulnerabilities are listed as follows:

• CVE-2020-11612
• CVE-2021-3177
• CVE-2020-17530
• CVE-2019-17195
• CVE-2019-17195
• CVE-2020-11612
• CVE-2020-10878
• CVE-2020-14195

Oracle E-Business Suite multiple vulnerabilities:

This security update contains 17 security patches for Oracle Communications Applications. Three of these vulnerabilities may be remotely exploitable without requiring user credentials. The CVE IDs of high-risk vulnerabilities are listed as follows:

• CVE-2021-2355
• CVE-2021-2436
• CVE-2021-2359

Oracle Fusion Middleware multiple vulnerabilities:

This security update contains 48 security patches for Oracle Fusion Middleware. Thirty-five of these vulnerabilities may be remotely exploitable without requiring user credentials. The CVE IDs of high-risk vulnerabilities are listed as follows:

• CVE-2021-2394
• CVE-2021-2397
• CVE-2021-2382
• CVE-2021-2456
• CVE-2019-17195
• CVE-2020-10683
• CVE-2020-28052

Oracle Retail Applications multiple vulnerabilities:

This security update contains 23 security patches for Oracle Retail Applications. Fifteen of these vulnerabilities may be remotely exploitable without requiring user credentials. The CVE IDs of high-risk vulnerabilities are listed as follows:

• CVE-2021-21345
• CVE-2019-0219

Oracle July 2021 Critical Patch Update is summarized as follows:

Mitigation

Affected users should refer to the Appendix to download related patches as soon as possible and apply them as indicated in the readme file to ensure long-term effective protection.

Note: Official patches of Oracle can be downloaded only by those with a licensed account of the software. Such users can use that account to log in to https://support.oracle.com to obtain the latest patches.

Appendix: Information about Affected Products and Patches

Statement

This advisory is only used to describe a potential risk. NSFOCUS does not provide any commitment or promise on this advisory. NSFOCUS and the author will not bear any liability for any direct and/or indirect consequences and losses caused by transmitting and/or using this advisory. NSFOCUS reserves all the rights to modify and interpret this advisory. Please include this statement paragraph when reproducing or transferring this advisory. Do not modify this advisory, add/delete any information to/from it, or use this advisory for commercial purposes without permission from NSFOCUS.

About NSFOCUS

NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks. The company’s Intelligent Hybrid Security strategy utilizes both cloud and on-premises security platforms, built on a foundation of real-time global threat intelligence, to provide multi-layered, unified and dynamic protection against advanced cyber attacks.

NSFOCUS works with Fortune Global 500 companies, including four of the world’s five largest financial institutions, organizations in insurance, retail, healthcare, critical infrastructure industries as well as government agencies. NSFOCUS has technology and channel partners in more than 60 countries, is a member of both the Microsoft Active Protections Program (MAPP), and the Cloud Security Alliance (CSA). A wholly owned subsidiary of NSFOCUS Technologies Group Co., Ltd., the company has operations in the Americas, Europe, the Middle East and Asia Pacific.