CSIRT Panam\u00e1 Aviso 2022-04-22 Oracle: Actualizaciones cr\u00edticas en Oracle (abril 2022)<\/p>\n\n\n\n
Gravedad: Alta
Fecha de publicaci\u00f3n: Abril 22, 2022
\u00daltima revisi\u00f3n: Abril 22, 2022
Sitio web: https:\/\/www.oracle.com\/
Sistemas Afectados:<\/p>\n\n\n\n
\u2022 Engineered Systems Utilities, versiones 12.1.0.2, 19c y 21c;
\u2022 Enterprise Manager Base Platform, versiones 13.4.0.0 y 13.5.0.0;
\u2022 Enterprise Manager para Peoplesoft, versiones 13.4.1.1 y 13.5.1.1;
\u2022 Enterprise Manager para Storage Management, versi\u00f3n 13.4.0.0;
\u2022 Enterprise Manager Ops Center, versi\u00f3n 12.4.0.0;
\u2022 Helidon, versiones 1.4.7, 1.4.10 y 2.0.0-RC1;
\u2022 Instantis EnterpriseTrack, versiones 17.1, 17.2 y 17.3;
\u2022 JD Edwards EnterpriseOne Tools, versiones anteriores a 9.2.6.3;
\u2022 JD Edwards World Security, versi\u00f3n A9.4;
\u2022 Management Cloud Engine, versiones 1.5.0 y anteriores;
\u2022 Middleware Common Libraries y Tools, versiones 12.2.1.3.0, 12.2.1.4.0 y 14.1.1.0.0;
\u2022 MySQL Cluster, versiones 7.4.35 y anteriores, 7.5.25 y anteriores, 7.6.21 y anteriores y 8.0.28 y anteriores;
\u2022 MySQL Connectors, versiones 8.0.28 y anteriores;
\u2022 MySQL Enterprise Monitor, versiones 8.0.29 y anteriores;
\u2022 MySQL Server, versiones 5.7.37 y anteriores y 8.0.28 y anteriores;
\u2022 MySQL Workbench, versiones 8.0.28 y anteriores;
\u2022 Oracle Advanced Supply Chain Planning, versiones 12.1, 12.2;
\u2022 Oracle Agile Engineering Data Management, versi\u00f3n 6.2.1.0;
\u2022 Oracle Agile PLM, versi\u00f3n 9.3.6;
\u2022 Oracle Agile PLM MCAD Connector, versi\u00f3n 3.6;
\u2022 Oracle Application Express, versiones anteriores a 22.1;
\u2022 Oracle Application Testing Suite, versi\u00f3n 13.3.0.1;
\u2022 Oracle Autovue para Agile Product Lifecycle Management, versi\u00f3n 21.0.2;
\u2022 Oracle Banking Deposits y Lines of Credit Servicing, versi\u00f3n 2.12.0;
\u2022 Oracle Banking Enterprise Default Management, versiones 2.7.1, 2.10.0 y 2.12.0;
\u2022 Oracle Banking Loans Servicing, versi\u00f3n 2.12.0;
\u2022 Oracle Banking Party Management, versi\u00f3n 2.7.0;
\u2022 Oracle Banking Payments, versi\u00f3n 14.5;
\u2022 Oracle Banking Platform, versiones 2.6.2, 2.7.1 y 2.12.0;
\u2022 Oracle Banking Trade Finance, versi\u00f3n 14.5;
\u2022 Oracle Banking Treasury Management, versi\u00f3n 14.5;
\u2022 Oracle Blockchain Platform, versiones anteriores a 21.1.2;
\u2022 Oracle Business Intelligence Enterprise Edition, versiones 5.5.0.0.0, 5.9.0.0.0, 12.2.1.3.0 y 12.2.1.4.0;
\u2022 Oracle Business Process Management Suite, versiones 12.2.1.3.0 y 12.2.1.4.0;
\u2022 Oracle Coherence, versiones 12.2.1.3.0, 12.2.1.4.0 y 14.1.1.0.0;
\u2022 Oracle Commerce Guided Search, versi\u00f3n 11.3.2;
\u2022 Oracle Communications ASAP, versi\u00f3n 7.3;
\u2022 Oracle Communications Billing y Revenue Management, versiones 12.0.0.4 y 12.0.0.5;
\u2022 Oracle Communications Cloud Native Core Automated Test Suite, versiones 1.8.0, 1.9.0 y 22.1.0;
\u2022 Oracle Communications Cloud Native Core Binding Support Function, versi\u00f3n 1.11.0;
\u2022 Oracle Communications Cloud Native Core Console, versiones 1.9.0 y 22.1.0;
\u2022 Oracle Communications Cloud Native Core Network Exposure Function, versi\u00f3n 22.1.0;
\u2022 Oracle Communications Cloud Native Core Network Function Cloud Native Environment, versiones 1.10.0 y 22.1.0;
\u2022 Oracle Communications Cloud Native Core Network Repository Function, versiones 1.15.0, 1.15.1 y 22.1.0;
\u2022 Oracle Communications Cloud Native Core Network Slice Selection Function, versiones 1.8.0 y 22.1.0;
\u2022 Oracle Communications Cloud Native Core Policy, versiones 1.14.0, 1.15.0 y 22.1.0;
\u2022 Oracle Communications Cloud Native Core Security Edge Protection Proxy, versiones 1.7.0 y 22.1.0;
\u2022 Oracle Communications Cloud Native Core Service Communication Proxy, versi\u00f3n 1.15.0;
\u2022 Oracle Communications Cloud Native Core Unified Data Repository, versiones 1.15.0 y 22.1.0;
\u2022 Oracle Communications Contacts Server, versi\u00f3n 8.0.0.6.0;
\u2022 Oracle Communications Convergence, versiones 3.0.2.2 y 3.0.3.0;
\u2022 Oracle Communications Convergent Charging Controller, versiones 6.0.1.0.0 y 12.0.1.0.0-12.0.4.0.0;
\u2022 Oracle Communications Design Studio, versiones 7.3.5 y 7.4.0-7.4.2;
\u2022 Oracle Communications Diameter Intelligence Hub, versiones 8.0.0-8.2.3;
\u2022 Oracle Communications Diameter Signaling Router, versi\u00f3n 8.4.0.0;
\u2022 Oracle Communications EAGLE Application Processor;
\u2022 Oracle Communications EAGLE Element Management System, versi\u00f3n 46.6;
\u2022 Oracle Communications EAGLE FTP Table Base Retrieval, versi\u00f3n 4.5;
\u2022 Oracle Communications EAGLE LNP Application Processor, versiones 10.1 y 10.2;
\u2022 Oracle Communications EAGLE Software, versiones 46.7.0, 46.8.0-46.8.2 y 46.9.1-46.9.3;
\u2022 Oracle Communications Element Manager, versiones anteriores a 9.0;
\u2022 Oracle Communications Evolved Communications Application Server, versi\u00f3n 7.1;
\u2022 Oracle Communications Instant Messaging Server, versi\u00f3n 10.0.1.5.0;
\u2022 Oracle Communications Interactive Session Recorder, versi\u00f3n 6.4;
\u2022 Oracle Communications IP Service Activator, versi\u00f3n 7.4.0;
\u2022 Oracle Communications Messaging Server, versi\u00f3n 8.1;
\u2022 Oracle Communications MetaSolv Solution, versi\u00f3n 6.3.1;
\u2022 Oracle Communications Network Charging y Control, versiones 6.0.1.0.0 y 12.0.1.0.0-12.0.4.0.0;
\u2022 Oracle Communications Network Integrity, versiones 7.3.2, 7.3.5 y 7.3.6;
\u2022 Oracle Communications Operations Monitor, versiones 4.3, 4.4 y 5.0;
\u2022 Oracle Communications Order y Service Management, versiones 7.3 y 7.4;
\u2022 Oracle Communications Performance Intelligence Center (PIC) Software, versiones 10.3.0.0.0-10.3.0.2.1 y 10.4.0.1.0-10.4.0.3.1;
\u2022 Oracle Communications Policy Management, versiones 12.5.0.0.0 y 12.6.0.0.0;
\u2022 Oracle Communications Pricing Design Center, versiones 12.0.0.4 y 12.0.0.5;
\u2022 Oracle Communications Services Gatekeeper, versi\u00f3n 7.0.0.0.0;
\u2022 Oracle Communications Session Border Controller, versiones 8.4 y 9.0;
\u2022 Oracle Communications Session Report Manager, versiones anteriores a 9.0;
\u2022 Oracle Communications Session Route Manager, versiones anteriores a 9.0;
\u2022 Oracle Communications Unified Inventory Management, versiones 7.4.1 y 7.4.2;
\u2022 Oracle Communications Unified Session Manager, versiones 8.2.5 y 8.4.5;
\u2022 Oracle Communications User Data Repository, versi\u00f3n 12.4;
\u2022 Oracle Communications WebRTC Session Controller, versi\u00f3n 7.2.1;
\u2022 Oracle Data Integrator, versiones 12.2.1.3.0 y 12.2.1.4.0;
\u2022 Oracle Database Server, versiones 12.1.0.2, 19c y 21c;
\u2022 Oracle Documaker, versiones 12.6.0, 12.6.2-12.6.4 y 12.7.0;
\u2022 Oracle E-Business Suite, versiones 12.2.4-12.2.11, [EBS Cloud Manager y Backup Module] anteriores a 22.1.1.1, [Enterprise Command Center] 7.0 y [Enterprise Information Discovery] 7-9;
\u2022 Oracle Enterprise Communications Broker, versiones 3.2 y 3.3;
\u2022 Oracle Enterprise Session Border Controller, versiones 8.4 y 9.0;
\u2022 Oracle Ethernet Switch ES1-24, versi\u00f3n 1.3.1;
\u2022 Oracle Ethernet Switch TOR-72, versi\u00f3n 1.2.2;
\u2022 Oracle Financial Services Analytical Applications Infrastructure, versiones 8.0.6.0-8.0.9.0 y 8.1.0.0-8.1.2.0;
\u2022 Oracle Financial Services Behavior Detection Platform, versiones 8.0.6.0-8.0.8.0, 8.1.1.0, 8.1.1.1 y 8.1.2.0;
\u2022 Oracle Financial Services Enterprise Case Management, versiones 8.0.7.1, 8.0.7.2, 8.0.8.0, 8.0.8.1, 8.1.1.0, 8.1.1.1 y 8.1.2.0;
\u2022 Oracle Financial Services Revenue Management y Billing, versiones 2.7.0.0, 2.7.0.1 y 2.8.0.0;
\u2022 Oracle FLEXCUBE Universal Banking, versiones 11.83.3, 12.1-12.4, 14.0-14.3 y 14.5;
\u2022 Oracle Global Lifecycle Management OPatch;
\u2022 Oracle GoldenGate, versiones anteriores a 12.3.0.1.2 y 23.1;
\u2022 Oracle GoldenGate Application Adapters, versiones anteriores a 23.1;
\u2022 Oracle GoldenGate Big Data y Application Adapters, versiones anteriores a 23.1;
\u2022 Oracle GraalVM Enterprise Edition, versiones 20.3.5, 21.3.1 y 22.0.0.2;
\u2022 Oracle Health Sciences Empirica Signal, versiones 9.1.0.6 y 9.2.0.0;
\u2022 Oracle Health Sciences InForm, versiones 6.2.1.1, 6.3.2.1 y 7.0.0.0;
\u2022 Oracle Health Sciences InForm Publisher, versiones 6.2.1.1 y 6.3.1.1;
\u2022 Oracle Health Sciences Information Manager, versiones 3.0.1-3.0.4;
\u2022 Oracle Healthcare Data Repository, versiones 8.1.0 y 8.1.1;
\u2022 Oracle Healthcare Foundation, versiones 7.3.0.1-7.3.0.4;
\u2022 Oracle Healthcare Master Person Index, versi\u00f3n 5.0.1;
\u2022 Oracle Healthcare Translational Research, versiones 4.1.0 y 4.1.1;
\u2022 Oracle Hospitality Suite8, versiones 8.10.2 y 8.11.0-8.14.0;
\u2022 Oracle Hospitality Token Proxy Service, versi\u00f3n 19.2;
\u2022 Oracle HTTP Server, versiones 12.2.1.3.0 y 12.2.1.4.0;
\u2022 Oracle Hyperion BI+, versiones anteriores a 11.2.8.0;
\u2022 Oracle Hyperion Calculation Manager, versiones anteriores a 11.2.8.0;
\u2022 Oracle Hyperion Data Relationship Management, versiones anteriores a 11.2.8.0 y 11.2.9.0;
\u2022 Oracle Hyperion Financial Management, versiones anteriores a 11.2.8.0;
\u2022 Oracle Hyperion Infrastructure Technology, versiones anteriores a 11.2.8.0;
\u2022 Oracle Hyperion Planning, versiones anteriores a 11.2.8.0;
\u2022 Oracle Hyperion Profitability y Cost Management, versiones anteriores a 11.2.8.0;
\u2022 Oracle Hyperion Tax Provision, versiones anteriores a 11.2.8.0;
\u2022 Oracle Identity Management Suite, versiones 12.2.1.3.0 y 12.2.1.4.0;
\u2022 Oracle Identity Manager Connector, versiones 9.1.0 y 11.1.1.5.0;
\u2022 Oracle iLearning, versiones 6.2 y 6.3;
\u2022 Oracle Insurance Data Gateway, versi\u00f3n 1.0.1;
\u2022 Oracle Insurance Insbridge Rating y Underwriting, versiones 5.2.0, 5.4.0-5.6.0 y 5.6.1;
\u2022 Oracle Insurance Policy Administration, versiones 11.0.2, 11.1.0, 11.2.8, 11.3.0 y 11.3.1;
\u2022 Oracle Insurance Rules Palette, versiones 11.0.2, 11.1.0, 11.2.8, 11.3.0 y 11.3.1;
\u2022 Oracle Internet Directory, versiones 12.2.1.3.0 y 12.2.1.4.0;
\u2022 Oracle Java SE, versiones 7u331, 8u321, 11.0.14, 17.0.2 y 18;
\u2022 Oracle JDeveloper, versiones 12.2.1.3.0 y 12.2.1.4.0;
\u2022 Oracle Managed File Transfer, versiones 12.2.1.3.0 y 12.2.1.4.0;
\u2022 Oracle Middleware Common Libraries y Tools, versi\u00f3n 12.2.1.4.0;
\u2022 Oracle NoSQL Database;
\u2022 Oracle Outside In Technology, versi\u00f3n 8.5.5;
\u2022 Oracle Payment Interface, versiones 19.1 y 20.3;
\u2022 Oracle Product Lifecycle Analytics, versi\u00f3n 3.6.1.0;
\u2022 Oracle REST Data Services, versiones anteriores a 21.2;
\u2022 Oracle Retail Bulk Data Integration, versi\u00f3n 16.0.3;
\u2022 Oracle Retail Customer Insights, versiones 15.0.2 y 16.0.2;
\u2022 Oracle Retail Customer Management y Segmentation Foundation, versiones 17.0-19.0;
\u2022 Oracle Retail Data Extractor para Merchandising, versiones 15.0.2 y 16.0.2;
\u2022 Oracle Retail EFTLink, versiones 17.0.2, 18.0.1, 19.0.1, 20.0.1 y 21.0.0;
\u2022 Oracle Retail Extract Transform y Load, versi\u00f3n 13.2.8;
\u2022 Oracle Retail Financial Integration, versiones 14.1.3.2, 15.0.3.1, 16.0.1-16.0.3, 19.0.0 y 19.0.1;
\u2022 Oracle Retail Integration Bus, versiones 14.1.3.2, 15.0.3.1, 16.0.1-16.0.3, 19.0.0 y 19.0.1;
\u2022 Oracle Retail Invoice Matching, versi\u00f3n 16.0.3;
\u2022 Oracle Retail Merchandising System, versiones 16.0.3 y 19.0.1;
\u2022 Oracle Retail Service Backbone, versiones 14.1.3.2, 15.0.3.1, 16.0.1-16.0.3, 19.0.0 y 19.0.1;
\u2022 Oracle Retail Store Inventory Management, versiones 14.0.4.13, 14.1.3.5, 14.1.3.14, 15.0.3.3, 15.0.3.8 y 16.0.3.7;
\u2022 Oracle Retail Xstore Office Cloud Service, versiones 16.0.6, 17.0.4, 18.0.3, 19.0.2 y 20.0.1;
\u2022 Oracle Retail Xstore Point of Service, versiones 16.0.6, 17.0.4, 18.0.3, 19.0.2, 20.0.1 y 21.0.0;
\u2022 Oracle SD-WAN Edge, versiones 9.0 y 9.1;
\u2022 Oracle Secure Backup;
\u2022 Oracle Secure Global Desktop, versi\u00f3n 5.6;
\u2022 Oracle Solaris, versi\u00f3n 11;
\u2022 Oracle Solaris Cluster, versi\u00f3n 4;
\u2022 Oracle SQL Developer, versiones anteriores a 21.99;
\u2022 Oracle StorageTek ACSLS, versi\u00f3n 8.5.1;
\u2022 Oracle StorageTek Tape Analytics (STA), versi\u00f3n 2.4;
\u2022 Oracle Taleo Platform, versiones anteriores a 22.1;
\u2022 Oracle Transportation Management, versiones 6.4.3 y 6.5.1;
\u2022 Oracle Tuxedo, versi\u00f3n 12.2.2.0.0;
\u2022 Oracle Utilities Framework, versiones 4.3.0.1.0-4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0 y 4.4.0.3.0;
\u2022 Oracle VM VirtualBox, versiones anteriores a 6.1.34;
\u2022 Oracle Web Services Manager, versiones 12.2.1.3.0 y 12.2.1.4.0;
\u2022 Oracle WebCenter Portal, versiones 12.2.1.3.0 y 12.2.1.4.0;
\u2022 Oracle WebCenter Sites, versiones 12.2.1.3.0 y 12.2.1.4.0;
\u2022 Oracle WebLogic Server, versiones 12.2.1.3.0, 12.2.1.4.0 y 14.1.1.0.0;
\u2022 Oracle ZFS Storage Appliance Kit, versi\u00f3n 8.8;
\u2022 OSS Support Tools, versiones 2.12.42 y 18.3;
\u2022 PeopleSoft Enterprise CS Academic Advisement, versi\u00f3n 9.2;
\u2022 PeopleSoft Enterprise FIN Cash Management, versi\u00f3n 9.2;
\u2022 PeopleSoft Enterprise PeopleTools, versiones 8.58 y 8.59;
\u2022 PeopleSoft Enterprise PRTL Interaction Hub, versi\u00f3n 9.1;
\u2022 Primavera Unifier, versiones 17.7-17.12, 18.8, 19.12, 20.12 y 21.12.<\/p>\n\n\n\n
I.Descripci\u00f3n<\/p>\n\n\n\n
Oracle ha publicado una actualizaci\u00f3n cr\u00edtica con parches para corregir vulnerabilidades, que afectan a m\u00faltiples productos. Esta actualizaci\u00f3n resuelve 520 vulnerabilidades, algunas de las cuales son cr\u00edticas.<\/p>\n\n\n\n
II.Impacto<\/p>\n\n\n\n
Las vulnerabilidades que afectan a Oracle Solaris pueden afectar a Oracle ZFSSA, por lo que los clientes de Oracle deben consultar el documento sobre actualizaciones de parches cr\u00edticos de Oracle y Sun Systems Product Suite, My Oracle Support Note 2160904.1, para obtener informaci\u00f3n sobre las revisiones m\u00ednimas de los parches de seguridad necesarios para resolver los problemas de ZFSSA, publicados en las actualizaciones de parches cr\u00edticos y los boletines de Solaris de terceros.<\/p>\n\n\n\n
Los boletines de terceros de Solaris se utilizan para anunciar los parches de seguridad para el software de terceros distribuido con Oracle Solaris. Los clientes de Solaris 10 deben consultar los \u00faltimos conjuntos de parches de seguridad cr\u00edticos, detallados en el documento de disponibilidad de parches. Se puede consultar el \u00edndice de referencia de CVE y parches de Solaris (My Oracle Support Note 1448883.1) para obtener m\u00e1s informaci\u00f3n.<\/p>\n\n\n\n
Los usuarios que utilicen Java SE con un navegador pueden descargar la \u00faltima versi\u00f3n desde la web de Java. Los usuarios de las plataformas Windows y macOS X tambi\u00e9n pueden utilizar las actualizaciones autom\u00e1ticas para obtener la \u00faltima versi\u00f3n.<\/p>\n\n\n\n
La presencia de una vulnerabilidad en una contaminaci\u00f3n de prototipos en una dependencia de jQuery y Cross-Site Scripting (XSS) almacenado.<\/p>\n\n\n\n
III. Referencia a soluciones, herramientas e informaci\u00f3n<\/p>\n\n\n\n
Actualizar las versiones correspondientes, mediante el siguiente enlace: https:\/\/www.oracle.com\/security-alerts\/cpuapr2022.html<\/p>\n\n\n\n
Fuentes:<\/p>\n\n\n\n
Informaci\u00f3n de contacto<\/p>\n\n\n\n
CSIRT PANAMA
Computer Security Incident Response Team Autoridad Nacional para la Innovacion Gubernamental
E-Mail: info@cert.pa
Phone: +507 520-CERT (2378)
Web: https:\/\/cert.pa
Twitter: @CSIRTPanama
Key ID: 16F2B124<\/p>\n","protected":false},"excerpt":{"rendered":"
CSIRT Panam\u00e1 Aviso 2022-04-22 Oracle: Actualizaciones cr\u00edticas en Oracle (abril 2022) Gravedad: AltaFecha de publicaci\u00f3n: Abril 22, 2022\u00daltima revisi\u00f3n: Abril 22, 2022Sitio web: https:\/\/www.oracle.com\/Sistemas Afectados: \u2022 Engineered Systems Utilities, versiones 12.1.0.2, 19c y 21c;\u2022 Enterprise…<\/p>\n","protected":false},"author":4,"featured_media":443,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[4],"tags":[],"class_list":["post-3036","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-avisos-de-seguridad"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/3036","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3036"}],"version-history":[{"count":1,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/3036\/revisions"}],"predecessor-version":[{"id":3037,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/3036\/revisions\/3037"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/media\/443"}],"wp:attachment":[{"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3036"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3036"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3036"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}