Oracle HTTP Server 12.2.1.4.0 SSL Module information disclosure

Summaryinfo

A vulnerability has been found in Oracle HTTP Server 12.2.1.4.0 and classified as critical. This vulnerability affects unknown code of the component SSL Module. This manipulation causes information disclosure. This vulnerability is tracked as CVE-2022-43551. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Oracle HTTP Server 12.2.1.4.0 (Web Server). It has been declared as critical. Affected by this vulnerability is an unknown part of the component SSL Module. The manipulation with an unknown input leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality. The summary by CVE is:

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) `.`. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded.

The weakness was disclosed 04/18/2023 as Oracle Critical Patch Update Advisory - April 2023. The advisory is shared at oracle.com. This vulnerability is known as CVE-2022-43551. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 211153 (Fedora 37 : curl (2022-d7ee33d4ad)), which helps to determine the existence of the flaw in a target environment.

A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (211153). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Web Server

Vendor

• Oracle

Name

• HTTP Server

Version

• 12.2.1.4.0

License

• commercial

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion