SB2019071691 - Multiple vulnerabilities in Oracle FLEXCUBE Private Banking
Published: July 16, 2019
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Infinite loop (CVE-ID: CVE-2018-17197)
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists due to an infinite loop when handling malicious input. A remote attacker can supply a carefully crafted or corrupt sqlite file, trigger and an infinite loop in Apache Tika's SQLite3Parser and cause the service to crash.
2) Improper input validation (CVE-ID: CVE-2018-15756)
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists in Pivotal Software Spring Framework due to improper handling of range requests. A remote attacker can send a specially crafted request that contains an additional range header with a high number of ranges or with wide ranges that overlap and cause the service to crash.
3) Man-in-the-middle attack (CVE-ID: CVE-2018-8039)
The vulnerability allows a remote authenticated attacker to conduct man-in-the-middle attack on the target system.The weakness exists due to improper verification of TLS hostnames when used with the 'com.sun.net.ssl' implementation. A remote attacker can conduct a man-in-the-middle attack and bypass the hostname verification.
Remediation
Install update from vendor's website.