Oracle Security Service 11.1.1.9.0/12.2.1.3.0/12.2.1.4.0 SSL API

Summaryinfo

A vulnerability was found in Oracle Security Service 11.1.1.9.0/12.2.1.3.0/12.2.1.4.0. It has been rated as critical. This issue affects some unknown processing of the component SSL API. This manipulation causes an unknown weakness. This vulnerability is registered as CVE-2020-14655. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in Oracle Security Service 11.1.1.9.0/12.2.1.3.0/12.2.1.4.0 and classified as critical. Affected by this vulnerability is an unknown function of the component SSL API. As an impact it is known to affect confidentiality, and integrity. The summary by CVE is:

Vulnerability in the Oracle Security Service product of Oracle Fusion Middleware (component: SSL API). Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Security Service. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Security Service accessible data as well as unauthorized update, insert or delete access to some of Oracle Security Service accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N).

The weakness was published 07/15/2020 as Oracle Critical Patch Update Advisory - July 2020 as confirmed advisory (Website). The advisory is shared at oracle.com. This vulnerability is known as CVE-2020-14655. The exploitation appears to be difficult. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available.

Upgrading eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Similar entries are available at VDB-158073, VDB-158074, VDB-158075 and VDB-158076. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Oracle

Name

• Security Service

Version

• 11.1.1.9.0
• 12.2.1.3.0
• 12.2.1.4.0

License

• commercial

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion