Oracle Enterprise Manager For Storage Management vulnerabilities

7 CVEs affecting Oracle Enterprise Manager For Storage Management, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-3450, published 2021-03-25.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-3449, published 2021-03-25. Medium severity, CVSS 5.9. EPSS: 63.5% chance of exploitation in the next 30 days. An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where…
CVE-2020-1967, published 2020-04-21. High severity, CVSS 7.5. EPSS: 53.3% chance of exploitation in the next 30 days. Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the…
CVE-2021-23840, published 2021-02-16. High severity, CVSS 7.5. EPSS: 50.7% chance of exploitation in the next 30 days. Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an…
CVE-2021-3450, published 2021-03-25. High severity, CVSS 7.4. EPSS: 18.3% chance of exploitation in the next 30 days. The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to…
CVE-2021-23841, published 2021-02-16. Medium severity, CVSS 5.9. EPSS: 7.4% chance of exploitation in the next 30 days. The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails…
CVE-2020-1971, published 2020-12-08. Medium severity, CVSS 5.9. EPSS: 7.1% chance of exploitation in the next 30 days. The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares…
CVE-2021-23839, published 2021-02-16. Low severity, CVSS 3.7. EPSS: 3% chance of exploitation in the next 30 days. OpenSSL 1.0.2 supports SSLv2. If a client attempts to negotiate SSLv2 with a server that is configured to support both SSLv2 and more recent SSL and TLS versions then a check is made for a version…