CVE-2019-17359
High
Description
The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Oracle Data Integrator
PublishedOct 8, 2019
First seenOct 8, 2019
How to fix
Update
- org.bouncycastle:bcprov-jdk141.64 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| oracle data_integrator | 12.2.1.4.0 | — |
| bouncycastle bc-java | 1.63 | — |
| apache tomee | 7.0.7, 7.1.2, 8.0.1 | — |
| netapp active_iq_unified_manager | 7.3 ≤ v, 9.5 ≤ v | — |
| netapp oncommand_api_services | No range specified | — |
| netapp oncommand_workflow_automation | No range specified | — |
| netapp service_level_manager | No range specified | — |
| oracle business_process_management_suite | 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle communications_convergence | 3.0.1.0 ≤ v ≤ 3.0.2.1 | — |
| oracle communications_diameter_signaling_router | 8.0.0 ≤ v ≤ 8.2.2 | — |
| oracle communications_session_route_manager | 8.2.0 ≤ v ≤ 8.2.2 | — |
| oracle financial_services_analytical_applications_infrastructure | 8.0.6 ≤ v ≤ 8.0.9 | — |
| oracle flexcube_private_banking | 12.0.0, 12.1.0 | — |
| oracle hospitality_guest_access | 4.2.0 | — |
| oracle managed_file_transfer | 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle peoplesoft_enterprise_hcm_global_payroll_switzerland | 9.2 | — |
| oracle peoplesoft_enterprise_peopletools | 8.56, 8.57, 8.58 | — |
| oracle retail_xstore_point_of_service | 18.0.1 | — |
| oracle soa_suite | 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle webcenter_portal | 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle weblogic_server | 12.2.1.3.0, 12.2.1.4.0 | — |
| org.bouncycastle:bcprov-jdk14Maven | 1.63 ≤ v < 1.64 | 1.64 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.