CVE-2022-23437
Medium
Description
There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Apache Xerces-j
PublishedJan 24, 2022
First seenJan 24, 2022
How to fix
Update
- oracle communications_element_manager9.0 or later
- oracle communications_session_report_manager9.0 or later
- oracle communications_session_route_manager9.0 or later
- oracle financial_services_analytical_applications_infrastructure8.1.2.0 or later
- oracle global_lifecycle_management_nextgen_oui_framework13.9.4.2.2 or later
- oracle global_lifecycle_management_opatch12.2.0.1.30 or later
- xerces:xercesImpl2.12.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache xerces-j | v ≤ 2.12.1 | — |
| oracle agile_engineering_data_management | 6.2.1.0 | — |
| oracle agile_product_lifecycle_management | 9.3.6 | — |
| oracle banking_deposits_and_lines_of_credit_servicing | 2.7 | — |
| oracle banking_party_management | 2.7.0 | — |
| oracle communications_asap | 7.3 | — |
| oracle communications_element_manager | v < 9.0 | 9.0 |
| oracle communications_session_report_manager | v < 9.0 | 9.0 |
| oracle communications_session_route_manager | v < 9.0 | 9.0 |
| oracle financial_services_analytical_applications_infrastructure | 8.0.6.0.0 ≤ v ≤ 8.0.9.0, 8.1.0.0 ≤ v < 8.1.2.0 | 8.1.2.0 |
| oracle financial_services_behavior_detection_platform | 8.0.6.0.0 ≤ v ≤ 8.0.8.0, 8.1.1.0, 8.1.1.1, 8.1.2.0 | — |
| oracle financial_services_crime_and_compliance_management_studio | 8.0.8.2.0, 8.0.8.3.0 | — |
| oracle financial_services_enterprise_case_management | 8.0.7.1, 8.0.7.2.0, 8.0.8.0, 8.0.8.1, 8.1.1.0, 8.1.1.1 | — |
| oracle flexcube_universal_banking | 12.4.0 | — |
| oracle global_lifecycle_management_nextgen_oui_framework | v < 13.9.4.2.2, 13.9.4.2.2 | 13.9.4.2.2 |
| oracle global_lifecycle_management_opatch | v < 12.2.0.1.30 | 12.2.0.1.30 |
| oracle health_sciences_information_manager | 3.0.1 ≤ v ≤ 3.0.5, 3.0.0.1 | — |
| oracle ilearning | 6.2, 6.3 | — |
| oracle peoplesoft_enterprise_peopletools | 8.58, 8.59 | — |
| oracle primavera_gateway | 17.7 ≤ v ≤ 17.12.11, 18.8.0 ≤ v ≤ 18.8.14, 19.12.0 ≤ v ≤ 19.12.13, 20.12.0 ≤ v ≤ 20.12.8 | — |
| oracle product_lifecycle_analytics | 3.6.1 | — |
| oracle retail_bulk_data_integration | 16.0.3.0 | — |
| oracle retail_extract_transform_and_load | 13.2.8 | — |
| oracle retail_financial_integration | 14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1 | — |
| oracle retail_integration_bus | 14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1 | — |
| oracle retail_merchandising_system | 16.0.3, 19.0.1 | — |
| oracle retail_service_backbone | 14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1 | — |
| oracle weblogic_server | 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 | — |
| netapp active_iq_unified_manager | No range specified | — |
| xerces:xercesImplMaven | v < 2.12.2 | 2.12.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.