Alert GCSA-23006 - Oracle Critical Patch Update Advisory - January 2023

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256





******************************************************************

Alert ID: GCSA-23006
Data: 20 Gennaio 2023
Titolo: Oracle Critical Patch Update Advisory - January 2023

******************************************************************

:: Descrizione del problema

Oracle ha rilasciato la Critical Patch Update January 2023.
L'aggiornamento risolve 327 vulnerabilita' che sono presenti
in vari prodotti, di cui 146 con gravita' "alta" e 71 con
gravita' "critica".

Un aggressore remoto potrebbe sfruttare alcune di queste
vulnerabilita' per prendere il controllo di un sistema interessato.
Oracle raccomanda di applicare gli aggiornamenti appena possibile.

Maggiori informazioni sono disponibili alla sezione "Riferimenti".


:: Software interessato

Big Data Graph
Commerce
Communications
Communications Applications
Construction and Engineering
Database Server
E-Business Suite
Enterprise Manager
Essbase
Financial Services Applications
Food and Beverage Applications
Fusion Middleware
Global Lifecycle Management
GoldenGate
Graph Server and Client
Health Sciences Applications
HealthCare Applications
Hospitality Applications
Hyperion
Insurance Applications
Java SE
JD Edwards
MySQL
PeopleSoft
Retail Applications
Siebel CRM
Spatial Studio
Supply Chain
Support Tools
Systems
TimesTen In-Memory Database
Utilities Applications
Virtualization

Per una descrizione completa si rimanda alla segnalazione ufficiale
nella sezione "Riferimenti".


:: Impatto

Denial of Service (DoS)
Data Manipulation (Tampering)
Esecuzione remota di codice arbitrario (RCE)
Rivelazione di informazioni (ID)
Bypass delle funzionalita' di sicurezza (SFB)

L'impatto delle vulnerabilita' varia a seconda del prodotto,
della componente e della configurazione del sistema.


:: Soluzioni

Applicare le patch appropriate o procedere all'opportuno
aggiornamento secondo le istruzioni rilasciate da Oracle.

Alcune applicazioni che utilizzano i software interessati
potrebbero non funzionare correttamente dopo l'aggiornamento
alla versione piu' recente. Effettuare l'aggiornamento
dopo aver considerato ogni possibile impatto.

Java SE Downloads
https://www.oracle.com/java/technologies/javase-downloads.html

Free Java Download
https://java.com/en/download/


:: Riferimenti

Oracle Critical Patch Update
https://www.oracle.com/security-alerts/cpujan2023.html
https://www.oracle.com/security-alerts/cpujan2023verbose.html

Oracle Critical Patch Updates, Security Alerts and Bulletins
https://www.oracle.com/security-alerts/

Oracle Java SE Support Roadmap
https://www.oracle.com/java/technologies/java-se-support-roadmap.html

CSIRT Italia
https://www.csirt.gov.it/contenuti/critical-patch-update-di-oracle-al05-230118-csirt-ita

I riferimenti CVE sono disponibili nell'advisory originale
Di seguito solo i Mitre CVE con gravita' "critica"
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1273
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7489
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17571
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10683
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36242
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31805
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3918
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41411
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2274
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22965
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22978
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23219
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23221
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23305
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23457
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25236
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2526
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25315
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27404
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31692
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31813
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32221
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33980
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37434
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37454
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40664
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42889
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42915
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42920
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43403
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45047
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21890




GARR CERT Security Alert - subscribe/unsubscribe:
http://www.cert.garr.it/alert/ricevi-gli-alert-di-cert




-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iEYEAREIAAYFAmPKaJwACgkQwZxMk2USYEJ2mACgruLLXUD6X9WCgOCc5IgOMhc8
ojYAn3gU0dLXMsXhqThD+DB6g73VFLBs
=DND2
-----END PGP SIGNATURE-----