GHSA-5pm2-9mr2-3frq

Source

https://github.com/advisories/GHSA-5pm2-9mr2-3frq

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/01/GHSA-5pm2-9mr2-3frq/GHSA-5pm2-9mr2-3frq.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-5pm2-9mr2-3frq

Aliases

CVE-2023-21893

Published

2023-01-18T00:30:16Z

Modified

2024-09-17T16:34:55.050250Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Component takeover in Oracle Data Provider for .NET

Details

Vulnerability in the Oracle Data Provider for .NET component of Oracle Database Server. Supported versions that are affected are 19c and 21c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCPS to compromise Oracle Data Provider for .NET. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Data Provider for .NET. Note: Applies also to Database client-only on Windows platform. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).

See the readme.txt files inside the .nupkg packages for a reference to the fix.

Database specific

{
    "nvd_published_at": "2023-01-18T00:15:00Z",
    "cwe_ids": [
        "CWE-284"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-04-12T23:07:14Z"
}

References

Affected packages

NuGet / Oracle.ManagedDataAccess

Package

Name: Oracle.ManagedDataAccess; View open source insights on deps.dev
Purl: pkg:nuget/Oracle.ManagedDataAccess

Affected ranges

Type: ECOSYSTEM
Events: Introduced

21.0.0

Fixed

21.9.0

Affected versions

21.*

21.3.0

21.4.0

21.5.0

21.6.1

21.7.0

21.8.0

NuGet / Oracle.ManagedDataAccess.Core

Package

Name: Oracle.ManagedDataAccess.Core; View open source insights on deps.dev
Purl: pkg:nuget/Oracle.ManagedDataAccess.Core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.21.0

Fixed

3.21.90

Affected versions

3.*

3.21.1

3.21.3

3.21.4

3.21.41

3.21.50

3.21.61

3.21.70

3.21.80

NuGet / Oracle.ManagedDataAccess

Package

Name: Oracle.ManagedDataAccess; View open source insights on deps.dev
Purl: pkg:nuget/Oracle.ManagedDataAccess

Affected ranges

Type: ECOSYSTEM
Events: Introduced

19.0.0

Fixed

19.18.0

Affected versions

19.*

19.3.0

19.3.1

19.5.0

19.6.0

19.7.0

19.8.0

19.9.0

19.10.0

19.10.1

19.11.0

19.12.0

19.13.0

19.14.0

19.15.1

19.16.0

19.17.0

NuGet / Oracle.ManagedDataAccess.Core

Package

Name: Oracle.ManagedDataAccess.Core; View open source insights on deps.dev
Purl: pkg:nuget/Oracle.ManagedDataAccess.Core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.19.0

Fixed

2.19.180

Affected versions

2.*

2.19.3

2.19.31

2.19.50

2.19.60

2.19.70

2.19.80

2.19.90

2.19.91

2.19.100

2.19.101

2.19.110

2.19.120

2.19.130

2.19.131

2.19.140

2.19.151

2.19.160

2.19.170