Oracle has released a scheduled update for its products (Critical Patch Update) aimed at addressing critical issues and vulnerabilities. The April update has resolved a total of 520 vulnerabilities.
Some issues:
- There are 6 security issues in Java SE. All vulnerabilities can be exploited remotely without authentication and affect environments that allow the execution of untrusted code. Two of these issues have been assigned a severity level of 7.5. The vulnerabilities have been fixed in releases Java SE 18.0.1, 11.0.15, and 8u331.
One of the issues (CVE-2022-21449) allows for the generation of a fake ECDSA digital signature using zero curve parameters (if the parameters are zero, the curve goes to infinity, which is why zero values are explicitly prohibited in the specification). There was no check for zero ECDSA parameter values in the Java libraries, so when processing signatures with zero parameters, Java considered them valid in all cases.
This vulnerability could also be used to generate fake for TLS certificates, which would be accepted in Java as valid, as well as to bypass authentication through WebAuthn and create fake JWT signatures and OIDC tokens. In other words, the vulnerability allows for the generation of universal certificates and signatures that will be accepted and recognized as valid in Java handlers using the standard java.security.* classes for verification. This issue manifests in Java versions 15, 16, 17, and 18. An example of generating fake certificates is available. jshell> import java.security.* jshell> var keys = KeyPairGenerator.getInstance("EC").generateKeyPair() keys ==> java.security.KeyPair@626b2d4a jshell> var blankSignature = new byte[64] blankSignature ==> byte[64] { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, … , 0, 0, 0, 0, 0, 0, 0, 0 } jshell> var sig = Signature.getInstance("SHA256WithECDSAInP1363Format") sig ==> Signature object: SHA256WithECDSAInP1363Format jshell> sig.initVerify(keys.getPublic()) jshell> sig.update("Hello, World".getBytes()) jshell> sig.verify(blankSignature) $8 ==> true
- There are 26 vulnerabilities in server MySQL, of which two can be exploited remotely. The most serious issues associated with OpenSSL and protobuf have been assigned severity levels of 7.5. Less critical vulnerabilities affect the optimizer, InnoDB, replication, PAM plugin, DDL, DML, FTS, and logging. The issues have been resolved in the releases of MySQL Community Server 8.0.29 and 5.7.38.
- 5 vulnerabilities in VirtualBox. The problems have been assigned a danger level from 7.5 to 3.8 (the most dangerous vulnerability only manifests on the Windows platform). The vulnerabilities have been fixed in the VirtualBox 6.1.34 update.
- 6 vulnerabilities in Solaris. The issues affect the kernel and utilities. The most serious issue in the utilities has been assigned a danger level of 8.2. The vulnerabilities have been fixed in the Solaris 11.4 SRU44 update.
Source: opennet.ru
