Oracle PeopleSoft Enterprise PeopleTools 8.59/8.60 Security type confusion

Summaryinfo

A vulnerability categorized as critical has been discovered in Oracle PeopleSoft Enterprise PeopleTools 8.59/8.60. Affected by this issue is some unknown functionality of the component Security. Executing a manipulation can lead to an unknown weakness. This vulnerability appears as CVE-2023-0286. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability classified as critical was found in Oracle PeopleSoft Enterprise PeopleTools 8.59/8.60 (Enterprise Resource Planning Software). This vulnerability affects an unknown functionality of the component Security. The CWE definition for the vulnerability is CWE-843. The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type. As an impact it is known to affect confidentiality, and availability. CVE summarizes:

There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.

The weakness was presented 07/18/2023 as Oracle Critical Patch Update Advisory - July 2023 as confirmed advisory (Website). The advisory is shared for download at oracle.com. This vulnerability was named CVE-2023-0286. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 11/05/2025).

The vulnerability scanner Nessus provides a plugin with the ID 211573 (Oracle Linux 9 : openssl / and / openssl-fips-provider (ELSA-2024-9333)), which helps to determine the existence of the flaw in a target environment.

A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (211573). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Enterprise Resource Planning Software

Vendor

• Oracle

Name

• PeopleSoft Enterprise PeopleTools

Version

• 8.59
• 8.60

License

• commercial

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion