EXPOSURES › CVE-2022-23219
CVE-2022-23219
CRITICAL
DETAIL
SourceNVD · cve
Published2022-01-14
CVSS9.8
Referencehttps://nvd.nist.gov/vuln/detail/CVE-2022-23219 ↗
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
PLAYERS IMPLICATED
Oracle · vendordebian · vendorgnu · vendorcommunications cloud native core binding support function · productcommunications cloud native core network function cloud native environment · productcommunications cloud native core network repository function · productcommunications cloud native core security edge protection proxy · productcommunications cloud native core unified data repository · productdebian linux · productenterprise operations monitor · productglibc · product
DESCRIPTION
The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.
AFFECTED FEDRAMP PRODUCTS · 10
| PRODUCT | STATUS |
|---|---|
| Aconex for Defense Oracle |
Authorized |
| Federal Managed Cloud Services Oracle |
Authorized |
| Fusion Cloud Oracle |
Authorized |
| Government Cloud - Common Controls Oracle |
Authorized |
| Oracle Cloud Infrastructure-Government Cloud Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) - Moderate Oracle |
In Process |
| Oracle Service Cloud Oracle |
Authorized |
| Oracle Service Cloud (DOD) Oracle |
Authorized |
| Taleo Cloud - U.S. Government Cloud Oracle |
Authorized |