Oracle addresses 266 CVEs in its first quarterly update of 2022 with 497 patches, including 25 critical updates.

Background

On January 18, Oracle released its Critical Patch Update (CPU) for January 2022, the first quarterly update of the year. This CPU contains fixes for 266 CVEs in 497 security updates across 39 Oracle product families. Out of the 497 security updates published this quarter, 6.6% of patches were assigned a critical severity. Medium severity patches accounted for the bulk of security patches at 46.5%, followed by high severity patches at 41.9%.

This quarter’s update includes 33 critical patches across 25 CVEs.

SeverityIssues PatchedCVEsCritical3325High20863Medium231154Low2524Total497266

Analysis

This quarter, the Oracle Communications product family contained the highest number of patches at 84, accounting for 16.9% of the total patches, followed by Oracle MySQL at 78 patches, which accounted for 15.7% of the total patches.

Oracle fixes Log4Shell and associated vulnerabilities across some of its product suites

As part of the January 2022 CPU, Oracle addressed CVE-2021-44228, the Apache Log4Shell vulnerability disclosed in December 2021 as well as associated Log4j vulnerabilities that have been disclosed in the weeks since.

Oracle did not explicitly provide details within this release regarding CVE-2021-44228 and which components were affected. Instead, they broadly highlighted that applying the January 2022 CPU would address CVE-2021-44228 and CVE-2021-45046 across the following products:

Oracle Communications
Oracle Construction and Engineering
Oracle Financial Services Applications
Oracle Fusion Middleware
Oracle Retail Applications
Oracle Siebel CRM

While it’s not clear if Oracle has completed an assessment of all product families to address all occurrences of the recently disclosed Log4j vulnerabilities, we will continue to monitor for further updates. In addition to the broader message, Oracle provided some details around affected products for the other associated Log4j vulnerabilities:

CVEProductComponentRemote Exploit without AuthCVE-2021-45105Oracle Communications WebRTC Session ControllerSignaling Engine, Media Engine (Apache Log4j)YesCVE-2021-45105Oracle Communications Services GatekeeperAPI Portal (Apache Log4j)YesCVE-2021-45105Instantis EnterpriseTrackLogging (Apache Log4j)YesCVE-2021-45105Oracle Retail Integration BusRIB Kernel (Apache Log4j)YesCVE-2021-45105Oracle Financial Services Analytical Applications InfrastructureOthers (Apache Log4j)YesCVE-2021-45105Oracle Retail Invoice MatchingSecurity (Apache Log4j)YesCVE-2021-45105Oracle Retail Service BackboneRSB Installation (Apache Log4j)YesCVE-2021-45105Oracle Retail Order BrokerSystem Administration (Apache Log4j)YesCVE-2021-45105Oracle WebCenter PortalSecurity Framework (Apache Log4j)YesCVE-2021-45105Oracle Managed File TransferMFT Runtime Server (Apache Log4j)YesCVE-2021-45105Oracle Business Intelligence Enterprise EditionAnalytics Server (Apache Log4j)YesCVE-2021-45105Oracle Retail Order Management SystemUpgrade Install (Apache Log4j)YesCVE-2021-45105Oracle Retail Point-of-ServiceAdministration (Apache Log4j)YesCVE-2021-45105Oracle Retail Predictive Application ServerRPAS Server (Apache Log4j)YesCVE-2021-45105Oracle Retail Price ManagementSecurity (Apache Log4j)YesCVE-2021-45105Oracle Communications Service BrokerIntegration (Apache Log4j)YesCVE-2021-45105Oracle Retail Returns ManagementSecurity (Apache Log4j)YesCVE-2021-45105Oracle Financial Services Model Management and GovernanceInstaller & Configuration (Apache Log4j)YesCVE-2021-45105Oracle Retail EFTLinkInstallation (Apache Log4j)YesCVE-2021-45105Oracle Retail Back OfficeSecurity (Apache Log4j)YesCVE-2021-45105Oracle Retail Central OfficeSecurity (Apache Log4j)YesCVE-2021-44832Oracle Communications Interactive Session RecorderRSS (Apache Log4j)NoCVE-2021-44832Primavera UnifierLogging (Apache Log4j)NoCVE-2021-44832Oracle WebLogic ServerCentralized Thirdparty Jars (Apache Log4j)NoCVE-2021-44832Oracle Communications Diameter Signaling RouterVirtual Network Function Manager, API Gateway (Apache Log4j)NoCVE-2021-44832Primavera GatewayAdmin (Apache Log4j)NoCVE-2021-44832Primavera P6 Enterprise Project Portfolio ManagementWeb Access (Apache Log4j)NoCVE-2021-44832Siebel UI FrameworkEnterprise Cache (Apache Log4j)NoCVE-2021-44832Oracle Retail Fiscal ManagementNF Issuing (Apache Log4j)NoCVE-2021-44832Oracle Retail Assortment PlanningApplication Core (Apache Log4j)NoCVE-2021-4104Oracle Retail AllocationGeneral (Apache Log4j)NoCVE-2021-4104Oracle Utilities Testing AcceleratorTools (Apache Log4j)NoCVE-2021-4104Oracle WebLogic ServerCentralized Thirdparty Jars (Apache Log4j)No

Oracle CPU Patch Breakdown

A full breakdown of the patches for this quarter can be seen in the following table, which also includes a count of vulnerabilities that can be exploited over a network without authentication.

Oracle Product FamilyNumber of PatchesRemote Exploit without AuthOracle Communications8450Oracle MySQL783Oracle Financial Services Applications4837Oracle Retail Applications4334Oracle Fusion Middleware3935Oracle Communications Applications3322Oracle Construction and Engineering2215Oracle Java SE1818Oracle PeopleSoft1310Oracle Utilities Applications137Oracle Systems117Oracle Supply Chain108Oracle E-Business Suite95Oracle Health Sciences Applications88Oracle Enterprise Manager76Oracle Insurance Applications76Oracle Commerce66Oracle TimesTen In-Memory Database53Oracle Database Server40Oracle Essbase43Oracle HealthCare Applications44Oracle Support Tools44Oracle GoldenGate33Oracle Hospitality Applications33Oracle Big Data Graph22Oracle Graph Server and Client22Oracle REST Data Services21Oracle Secure Backup22Oracle Siebel CRM21Oracle Virtualization20Oracle Airlines Data Model11Oracle Communications Data Model11Oracle NoSQL Database10Oracle Spatial Studio11Oracle Food and Beverage Applications11Oracle Hyperion11Oracle iLearning11Oracle JD Edwards10Oracle Policy Automation11

Solution

Customers are advised to apply all relevant patches in this quarter’s CPU. Please refer to the January 2022 advisory for full details.

Identifying affected systems

A list of Tenable plugins to identify these vulnerabilities will appear here as they’re released.

Get more information

Oracle Critical Patch Update Advisory – January 2022
Oracle October 2021 Critical Patch Update Risk Matrices
Oracle Advisory to CVE Map

Join Tenable’s Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

Read More