Oracle API Gateway vulnerabilities

12 CVEs affecting Oracle API Gateway, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-1971, published 2020-12-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-5645, published 2017-04-17. Critical severity, CVSS 9.8. EPSS: 89.8% chance of exploitation in the next 30 days. In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that,…
CVE-2015-3195, published 2015-12-06. Medium severity, CVSS 5.3. EPSS: 38.7% chance of exploitation in the next 30 days. The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed…
CVE-2019-1559, published 2019-02-27. Medium severity, CVSS 5.9. EPSS: 17.1% chance of exploitation in the next 30 days. If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling…
CVE-2018-0734, published 2018-10-30. Medium severity, CVSS 5.9. EPSS: 12.2% chance of exploitation in the next 30 days. The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in…
CVE-2019-17566, published 2020-11-12. High severity, CVSS 7.5. EPSS: 10.9% chance of exploitation in the next 30 days. Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this…
CVE-2020-11979, published 2020-10-01. High severity, CVSS 7.5. EPSS: 8% chance of exploitation in the next 30 days. As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task…
CVE-2020-1971, published 2020-12-08. Medium severity, CVSS 5.9. EPSS: 7.1% chance of exploitation in the next 30 days. The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares…
CVE-2018-1000613, published 2018-07-09. Critical severity, CVSS 9.8. EPSS: 4.8% chance of exploitation in the next 30 days. Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code…
CVE-2018-0735, published 2018-10-29. Medium severity, CVSS 5.9. EPSS: 4.7% chance of exploitation in the next 30 days. The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in…
CVE-2018-1000180, published 2018-06-05. High severity, CVSS 7.5. EPSS: 3.4% chance of exploitation in the next 30 days. Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added…

Latest

CVE-2018-5407, published 2018-11-15. Medium severity, CVSS 4.7. EPSS: 3.4% chance of exploitation in the next 30 days. Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.
CVE-2017-3601, published 2017-04-24. High severity, CVSS 8.1. EPSS: 2.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle API Gateway component of Oracle Fusion Middleware (subcomponent: Oracle API Gateway). The supported version that is affected is 11.1.2.4.0. Easily "exploitable"…