Oracle Security Patch Update – 17 April 2024

By /
  • 120/2024
  • Critical
  • 3:02 pm

Oracle released its critical patch updates for April 2024, containing (441) new security patches for multiple affected products in Oracle code and third-party components.

The addressed vulnerabilities could allow the attacker to perform various attacks such as obtaining sensitive information, performing denial of service attacks, bypassing security restrictions, and gaining access to the affected systems.

Sample of the addressed vulnerabilities:

1. Oracle Hospitality Simphony Security Vulnerability (CVE-2024-20997):

  • CVSS: 9.9
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Consequences: Gain Access

2. Oracle Communications Cloud Native Core Network Function Cloud Native Environment Security Bypass Vulnerability (CVE-2024-21626):

  • CVSS: 8.6
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Consequences: Bypass Security

Sample of the affected products:

  • Oracle MySQL Server.
  • Oracle Banking Branch.
  • Oracle Banking Cash Management.
  • Oracle Enterprise Manager.
  • Oracle Access Manager.

The complete list of the affected products: Oracle Advisory – April 2024

Vulnerabilities
Mitigations

The enterprise should deploy this patch as soon as the testing phase is completed.

Oracle Advisory – April 2024

References