Oracle Security Patch Update – 18 January 2024

By /
  • 22/2024
  • Critical

Oracle released its critical patch update for January 2024, containing (389) new security patches for multiple affected products in Oracle code and third-party components included in Oracle products.

The addressed vulnerabilities could allow the attacker to perform various attacks such as obtaining sensitive information, performing denial of service attacks, bypassing security restrictions, executing arbitrary code, and gaining access to the affected systems.

Sample of the addressed vulnerabilities:

1. Oracle Agile PLM Takeover Vulnerability (CVE-2024-20953):

  • CVSS: 8.8
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Consequences: Gain Access

2. Oracle Enterprise Manager Base Platform Denial of Service Vulnerability (CVE-2024-20916):

  • CVSS: 8.3
  • Attack Vector: Adjacent Network
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: None
  • Consequences: Denial of Service

Sample of the affected products:

  • Oracle MySQL Server.
  • Oracle Banking Branch.
  • Oracle Banking Cash Management.
  • Oracle Enterprise Manager.
  • Oracle Access Manager.

The complete list of the affected products: Oracle Advisory – January 2024

Vulnerabilities

Oracle Map of CVE to Advisory/Alert

Mitigations

The enterprise should deploy this patch as soon as the testing phase is completed.

Oracle Advisory – January 2024

References