Oracle Communications Session Router vulnerabilities

3 CVEs affecting Oracle Communications Session Router, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-1971, published 2020-12-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-1559, published 2019-02-27. Medium severity, CVSS 5.9. EPSS: 17.1% chance of exploitation in the next 30 days. If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling…
CVE-2020-1971, published 2020-12-08. Medium severity, CVSS 5.9. EPSS: 7.1% chance of exploitation in the next 30 days. The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares…
CVE-2020-8203, published 2020-07-15. High severity, CVSS 7.4. EPSS: 5.2% chance of exploitation in the next 30 days. Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.