Oracle January 2022 Critical Patch Update Addresses 266 CVEs
Oracle addresses 266 CVEs in its first quarterly update of 2022 with 497 patches, including 25 critical updates.
Background
On January 18, Oracle released its Critical Patch Update (CPU) for January 2022, the first quarterly update of the year. This CPU contains fixes for 266 CVEs in 497 security updates across 39 Oracle product families. Out of the 497 security updates published this quarter, 6.6% of patches were assigned a critical severity. Medium severity patches accounted for the bulk of security patches at 46.5%, followed by high severity patches at 41.9%.
This quarter’s update includes 33 critical patches across 25 CVEs.
| Severity | Issues Patched | CVEs |
|---|---|---|
| Critical | 33 | 25 |
| High | 208 | 63 |
| Medium | 231 | 154 |
| Low | 25 | 24 |
| Total | 497 | 266 |
Analysis
This quarter, the Oracle Communications product family contained the highest number of patches at 84, accounting for 16.9% of the total patches, followed by Oracle MySQL at 78 patches, which accounted for 15.7% of the total patches.
Oracle fixes Log4Shell and associated vulnerabilities across some of its product suites
As part of the January 2022 CPU, Oracle addressed CVE-2021-44228, the Apache Log4Shell vulnerability disclosed in December 2021 as well as associated Log4j vulnerabilities that have been disclosed in the weeks since.
Oracle did not explicitly provide details within this release regarding CVE-2021-44228 and which components were affected. Instead, they broadly highlighted that applying the January 2022 CPU would address CVE-2021-44228 and CVE-2021-45046 across the following products:
- Oracle Communications
- Oracle Construction and Engineering
- Oracle Financial Services Applications
- Oracle Fusion Middleware
- Oracle Retail Applications
- Oracle Siebel CRM
While it’s not clear if Oracle has completed an assessment of all product families to address all occurrences of the recently disclosed Log4j vulnerabilities, we will continue to monitor for further updates. In addition to the broader message, Oracle provided some details around affected products for the other associated Log4j vulnerabilities:
| CVE | Product | Component | Remote Exploit without Auth |
|---|---|---|---|
| CVE-2021-45105 | Oracle Communications WebRTC Session Controller | Signaling Engine, Media Engine (Apache Log4j) | Yes |
| CVE-2021-45105 | Oracle Communications Services Gatekeeper | API Portal (Apache Log4j) | Yes |
| CVE-2021-45105 | Instantis EnterpriseTrack | Logging (Apache Log4j) | Yes |
| CVE-2021-45105 | Oracle Retail Integration Bus | RIB Kernel (Apache Log4j) | Yes |
| CVE-2021-45105 | Oracle Financial Services Analytical Applications Infrastructure | Others (Apache Log4j) | Yes |
| CVE-2021-45105 | Oracle Retail Invoice Matching | Security (Apache Log4j) | Yes |
| CVE-2021-45105 | Oracle Retail Service Backbone | RSB Installation (Apache Log4j) | Yes |
| CVE-2021-45105 | Oracle Retail Order Broker | System Administration (Apache Log4j) | Yes |
| CVE-2021-45105 | Oracle WebCenter Portal | Security Framework (Apache Log4j) | Yes |
| CVE-2021-45105 | Oracle Managed File Transfer | MFT Runtime Server (Apache Log4j) | Yes |
| CVE-2021-45105 | Oracle Business Intelligence Enterprise Edition | Analytics Server (Apache Log4j) | Yes |
| CVE-2021-45105 | Oracle Retail Order Management System | Upgrade Install (Apache Log4j) | Yes |
| CVE-2021-45105 | Oracle Retail Point-of-Service | Administration (Apache Log4j) | Yes |
| CVE-2021-45105 | Oracle Retail Predictive Application Server | RPAS Server (Apache Log4j) | Yes |
| CVE-2021-45105 | Oracle Retail Price Management | Security (Apache Log4j) | Yes |
| CVE-2021-45105 | Oracle Communications Service Broker | Integration (Apache Log4j) | Yes |
| CVE-2021-45105 | Oracle Retail Returns Management | Security (Apache Log4j) | Yes |
| CVE-2021-45105 | Oracle Financial Services Model Management and Governance | Installer & Configuration (Apache Log4j) | Yes |
| CVE-2021-45105 | Oracle Retail EFTLink | Installation (Apache Log4j) | Yes |
| CVE-2021-45105 | Oracle Retail Back Office | Security (Apache Log4j) | Yes |
| CVE-2021-45105 | Oracle Retail Central Office | Security (Apache Log4j) | Yes |
| CVE-2021-44832 | Oracle Communications Interactive Session Recorder | RSS (Apache Log4j) | No |
| CVE-2021-44832 | Primavera Unifier | Logging (Apache Log4j) | No |
| CVE-2021-44832 | Oracle WebLogic Server | Centralized Thirdparty Jars (Apache Log4j) | No |
| CVE-2021-44832 | Oracle Communications Diameter Signaling Router | Virtual Network Function Manager, API Gateway (Apache Log4j) | No |
| CVE-2021-44832 | Primavera Gateway | Admin (Apache Log4j) | No |
| CVE-2021-44832 | Primavera P6 Enterprise Project Portfolio Management | Web Access (Apache Log4j) | No |
| CVE-2021-44832 | Siebel UI Framework | Enterprise Cache (Apache Log4j) | No |
| CVE-2021-44832 | Oracle Retail Fiscal Management | NF Issuing (Apache Log4j) | No |
| CVE-2021-44832 | Oracle Retail Assortment Planning | Application Core (Apache Log4j) | No |
| CVE-2021-4104 | Oracle Retail Allocation | General (Apache Log4j) | No |
| CVE-2021-4104 | Oracle Utilities Testing Accelerator | Tools (Apache Log4j) | No |
| CVE-2021-4104 | Oracle WebLogic Server | Centralized Thirdparty Jars (Apache Log4j) | No |
Oracle CPU Patch Breakdown
A full breakdown of the patches for this quarter can be seen in the following table, which also includes a count of vulnerabilities that can be exploited over a network without authentication.
| Oracle Product Family | Number of Patches | Remote Exploit without Auth |
|---|---|---|
| Oracle Communications | 84 | 50 |
| Oracle MySQL | 78 | 3 |
| Oracle Financial Services Applications | 48 | 37 |
| Oracle Retail Applications | 43 | 34 |
| Oracle Fusion Middleware | 39 | 35 |
| Oracle Communications Applications | 33 | 22 |
| Oracle Construction and Engineering | 22 | 15 |
| Oracle Java SE | 18 | 18 |
| Oracle PeopleSoft | 13 | 10 |
| Oracle Utilities Applications | 13 | 7 |
| Oracle Systems | 11 | 7 |
| Oracle Supply Chain | 10 | 8 |
| Oracle E-Business Suite | 9 | 5 |
| Oracle Health Sciences Applications | 8 | 8 |
| Oracle Enterprise Manager | 7 | 6 |
| Oracle Insurance Applications | 7 | 6 |
| Oracle Commerce | 6 | 6 |
| Oracle TimesTen In-Memory Database | 5 | 3 |
| Oracle Database Server | 4 | 0 |
| Oracle Essbase | 4 | 3 |
| Oracle HealthCare Applications | 4 | 4 |
| Oracle Support Tools | 4 | 4 |
| Oracle GoldenGate | 3 | 3 |
| Oracle Hospitality Applications | 3 | 3 |
| Oracle Big Data Graph | 2 | 2 |
| Oracle Graph Server and Client | 2 | 2 |
| Oracle REST Data Services | 2 | 1 |
| Oracle Secure Backup | 2 | 2 |
| Oracle Siebel CRM | 2 | 1 |
| Oracle Virtualization | 2 | 0 |
| Oracle Airlines Data Model | 1 | 1 |
| Oracle Communications Data Model | 1 | 1 |
| Oracle NoSQL Database | 1 | 0 |
| Oracle Spatial Studio | 1 | 1 |
| Oracle Food and Beverage Applications | 1 | 1 |
| Oracle Hyperion | 1 | 1 |
| Oracle iLearning | 1 | 1 |
| Oracle JD Edwards | 1 | 0 |
| Oracle Policy Automation | 1 | 1 |
Solution
Customers are advised to apply all relevant patches in this quarter’s CPU. Please refer to the January 2022 advisory for full details.
Identifying affected systems
A list of Tenable plugins to identify these vulnerabilities will appear here as they’re released.
Get more information
- Oracle Critical Patch Update Advisory - January 2022
- Oracle October 2021 Critical Patch Update Risk Matrices
- Oracle Advisory to CVE Map
Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.
Get a free 30-day trial of Tenable.io Vulnerability Management.
Related Articles
Context Is King: From Vulnerability Management to Exposure Management
November 7, 2024Vulnerability management remains a cornerstone of preventive cybersecurity, but organizations still struggle with vulnerability overload and sophisticated threats. Tenable’s new Exposure Signals gives security teams comprehensive context, so they can shift from vulnerability management to exposure management and effectively prioritize high-risk exposures across their complex attack surface.
Cybersecurity Snapshot: New Guides Offer Best Practices for Preventing Shadow AI and for Deploying Secure Software Updates
October 25, 2024Looking for help with shadow AI? Want to boost your software updates’ safety? New publications offer valuable tips. Plus, learn why GenAI and data security have become top drivers of cyber strategies. And get the latest on the top “no-nos” for software security; the EU’s new cyber law; and CISOs’ communications with boards.
Cybersecurity Snapshot: Tenable Report Warns About Toxic Cloud Exposures, as PwC Study Urges C-Suite Collaboration for Stronger Cyber Resilience
October 18, 2024Check out invaluable cloud security insights and recommendations from the “Tenable Cloud Risk Report 2024.” Plus, a PwC study says increased collaboration between CISOs and fellow CxOs boosts cyber resilience. Meanwhile, a report finds the top cyber skills gaps are in cloud security and AI. And get the latest on SBOMs; CIS Benchmarks; and cyber pros’ stress triggers.
Microsoft’s November 2024 Patch Tuesday Addresses 87 CVEs (CVE-2024-43451, CVE-2024-49039)
November 12, 2024Microsoft addresses 87 CVEs and one advisory (ADV240001) in its November 2024 Patch Tuesday release, with four critical vulnerabilities and four zero-day vulnerabilities, including two that were exploited in the wild.
Cybersecurity Snapshot: CISA Warns of Global Spear-Phishing Threat, While OWASP Releases AI Security Resources
November 8, 2024CISA is warning about a spear-phishing campaign that spreads malicious RDP files. Plus, OWASP is offering guidance about deepfakes and AI security. Meanwhile, cybercriminals have amplified their use of malware for fake software-update attacks. And get the latest on CISA’s international plan, Interpol’s cyber crackdown and ransomware trends.
Context Is King: From Vulnerability Management to Exposure Management
November 7, 2024Vulnerability management remains a cornerstone of preventive cybersecurity, but organizations still struggle with vulnerability overload and sophisticated threats. Tenable’s new Exposure Signals gives security teams comprehensive context, so they can shift from vulnerability management to exposure management and effectively prioritize high-risk exposures across their complex attack surface.
- Risk-based Vulnerability Management
- Vulnerability Management