Oracle Releases January 2022 Critical Patch Update
Scheduled updates for multiple Oracle Products
Summary
Scheduled updates for multiple Oracle Products
Affected platforms
The following platforms are known to be affected:
The following platforms are also known to be affected:
Multiple other platforms are affected. Please review the Oracle Critical Patch Update Advisory - January 2022 for more information.
Threat details
Introduction
Oracle has released its Critical Patch Update for January 2022 to address 497 vulnerabilities across multiple products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system.
Note: Oracle released a Security Alert on 10 December 2021 for Log4Shell in their advisory for Apache Log4j vulnerabilities CVE-2021-44228 and CVE-2021-45046. Affected organisations should review the alert in conjunction with the Critical Patch Update Advisory - January 2022 and apply any relevant updates.
CVE-2021-35587 in Oracle Fusion Middleware is Being Actively Exploited
CISA has added a vulnerability in the Oracle Fusion Middleware product to its Known Exploited Vulnerabilities Catalog. This vulnerability could allow a threat actor with network access to take control of Oracle Access Manager. CVE-2021-35587 has been given a CVSS 3.1 Base Score of 9.8.
Threat updates
| Date | Update |
|---|---|
| 29 Nov 2022 |
CISA Adds CVE-2021-35587 to Known Exploited Vulnerabilities Catalog
A vulnerability in the Oracle Fusion Middleware has been added to the CISA Known Exploited Vulnerabilities Catalog. This article has been updated to reflect this change. |
Remediation advice
Affected organisations are encouraged to review the Oracle January 2022 Critical Patch Update and apply the necessary updates.
Definitive source of threat updates
Last edited: 29 November 2022 2:41 pm