oracle patch release dates 2022

This Critical Patch Update contains 1 new security patch for Oracle Hyperion. 35 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. Thus, prior Critical Patch Update advisories should be reviewed for information regarding earlier published security patches. Security vulnerabilities are scored using CVSS version 3.1 (see Oracle CVSS Scoring for an explanation of how Oracle applies CVSS version 3.1).

Oracle continues to periodically receive reports of attempts to maliciously exploit vulnerabilities for which Oracle has already released security patches. The patch for CVE-2020-14756 also addresses CVE-2020-14642, CVE-2021-2277, CVE-2021-2344, CVE-2021-2371 and CVE-2021-2428. The patch for CVE-2021-22931 also addresses CVE-2021-22939 and CVE-2021-22940. This Critical Patch Update contains 2 new security patches for Oracle Virtualization. This Critical Patch Update contains 8 new security patches for Oracle Health Sciences Applications. 3 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The patch for CVE-2021-37695 also addresses CVE-2021-32808 and CVE-2021-32809. 7 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. Retail matrix version changes and added credit for CVE-2022-21353, Rev 3. The next four dates are: This Critical Patch Update contains 28 new security patches for Oracle Database Products divided as follows: This Critical Patch Update contains 4 new security patches plus additional third party patches noted below for Oracle Database Products. This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. Product releases that are not under Premier Support or Extended Support are not tested for the presence of vulnerabilities addressed by this Critical Patch Update. The patch for CVE-2020-17527 also addresses CVE-2020-13934, CVE-2020-13935, CVE-2020-9484, CVE-2021-25122, CVE-2021-25329, CVE-2021-30369, CVE-2021-30640 and CVE-2021-33037. Updated the version details and addtional CVEs (CVE-2022-23302, CVE-2022-23305 and CVE-2022-23307) forOracle WebLogic Server, Rev 5. The English text form of this Risk Matrix can be found here. Solaris 10 customers should refer to the latest patch-sets which contain critical security patches detailed in Systems Patch Availability Document. Oracle provides this information, in part, so that customers may conduct their own risk analysis based on the particulars of their product usage. The patch for CVE-2020-6950 also addresses CVE-2019-17091. For information on what patches need to be applied to your environments, refer to Critical Patch Update January 2022 Patch Availability Document for Oracle Products, My Oracle Support Note 2817011.1. This Critical Patch Update contains 3 new security patches for Oracle Hospitality Applications. Were sorry. Please see Reference Index of CVE IDs and Solaris Patches (, Users running Java SE with a browser can download the latest release from, Abdelrhman Yousri: CVE-2022-21246, CVE-2022-21402, CVE-2022-21403, Alexander Kornbrust of Red Database Security: CVE-2022-21247, Andrej Simko of Accenture: CVE-2022-21251, Anonymous researcher working with Trend Micro's Zero Day Initiative: CVE-2022-21279, CVE-2022-21280, CVE-2022-21284, CVE-2022-21285, CVE-2022-21286, CVE-2022-21287, CVE-2022-21288, CVE-2022-21289, CVE-2022-21290, CVE-2022-21307, CVE-2022-21308, CVE-2022-21309, CVE-2022-21346, Aobo Wang of Chaitin Security Research Lab: CVE-2022-21295, Dinh Ho Anh Khoa of Viettel Cyber Security: CVE-2021-35684, CVE-2022-21306, Fabian Meumertzheim of Code Intelligence: CVE-2022-21360, CVE-2022-21366, Frederic Quenneville of videotron.com: CVE-2022-21338, Hamed Ashraf: CVE-2022-21395, CVE-2022-21396, CVE-2022-21397, CVE-2022-21398, CVE-2022-21399, CVE-2022-21400, CVE-2022-21401, Harold Siyu Zang of Trustwave: CVE-2022-21381, CVE-2022-21382, CVE-2022-21383, Jie Liang of WingTecher Lab of Tsinghua University: CVE-2022-21303, CVE-2022-21304, Jingzhou Fu of WingTecher Lab of Tsinghua University: CVE-2022-21303, CVE-2022-21304, Jonni Passki of Apple Information Security: CVE-2022-21282, Kun Yang of Chaitin Security Research Lab: CVE-2022-21295, Liboheng of Tophant Starlight laboratory: CVE-2022-21261, Longofo of Knownsec 404 Team: CVE-2022-21252, CVE-2022-21260, Lucas Leong (wmliang) of Trend Micro Zero Day Initiative: CVE-2022-21310, CVE-2022-21311, CVE-2022-21312, CVE-2022-21313, CVE-2022-21314, CVE-2022-21315, CVE-2022-21316, CVE-2022-21317, CVE-2022-21318, CVE-2022-21319, CVE-2022-21320, CVE-2022-21321, CVE-2022-21322, CVE-2022-21323, CVE-2022-21324, CVE-2022-21325, CVE-2022-21326, CVE-2022-21327, CVE-2022-21328, CVE-2022-21329, CVE-2022-21330, CVE-2022-21331, CVE-2022-21332, CVE-2022-21333, CVE-2022-21334, CVE-2022-21335, CVE-2022-21336, CVE-2022-21337, CVE-2022-21355, CVE-2022-21356, CVE-2022-21357, CVE-2022-21380, Markus Loewe: CVE-2022-21293, CVE-2022-21294, osword from SGLAB of Legendsec at Qi'anxin Group: CVE-2022-21347, Patrick Star of BMH Security Team: CVE-2022-21353, peterjson - Security Engineering - VNG Corporation: CVE-2021-35587, r00t4dm: CVE-2022-21252, CVE-2022-21257, CVE-2022-21258, CVE-2022-21259, CVE-2022-21260, CVE-2022-21261, CVE-2022-21262, Reno Robert working with Trend Micro Zero Day Initiative: CVE-2022-21355, CVE-2022-21356, CVE-2022-21357, CVE-2022-21380, Ryota Shiga (Ga_ryo_) of Flatt Security working with Trend Micro Zero Day Initiative: CVE-2022-21394, Sander Meijering of HackDefense: CVE-2021-35685, CVE-2022-21371, Thijmen Kooy of HackDefense: CVE-2021-35685, CVE-2022-21371, thiscodecc of MoyunSec V-Lab: CVE-2022-21292, CVE-2022-21350, CVE-2022-21361, Yaoguang Chen of Ant Security Light-Year Lab: CVE-2022-21303, CVE-2022-21304, Zhiqiang Zang of University of Texas at Austin: CVE-2022-21305, Zhiyong Wu of WingTecher Lab of Tsinghua University: CVE-2022-21303, CVE-2022-21304, B.Dhiyaneshwaran aka (Geek Freak) [2 reports], Dor Tumarkin, Principal Application Security Researcher at Checkmarx, peterjson - Security Engineering - VNG Corporation, Quan Doan of R&D Center - VinCSS LLC (a member of Vingroup), 4 new security patches for Oracle Database Products, 1 new security patch for Oracle Airlines Data Model, 2 new security patches for Oracle Big Data Graph, 1 new security patch for Oracle Communications Data Model, 4 new security patches for Oracle Essbase, 3 new security patches for Oracle GoldenGate, 2 new security patches for Oracle Graph Server and Client, 1 new security patch for Oracle NoSQL Database, 2 new security patches for Oracle REST Data Services, 2 new security patches for Oracle Secure Backup, 1 new security patch for Oracle Spatial Studio, 5 new security patches for Oracle TimesTen In-Memory Database. As a result, Oracle recommends that customers upgrade to supported versions.

This Critical Patch Update contains 1 new security patch for Oracle JD Edwards. Please note that on December 10, 2021, Oracle released a Security Alert for Apache Log4j vulnerabilities CVE-2021-44228 and CVE-2021-45046. Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply Critical Patch Update security patches as soon as possible.

34 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. However, since vulnerabilities affecting Oracle Database and Oracle Fusion Middleware versions may affect Oracle E-Business Suite products, Oracle recommends that customers apply the January 2022 Critical Patch Update to the Oracle Database and Oracle Fusion Middleware components of Oracle E-Business Suite. The patch for CVE-2020-11979 also addresses CVE-2020-1945, CVE-2021-36373 and CVE-2021-36374. This Critical Patch Update contains 22 new security patches for Oracle Construction and Engineering. Oracle conducts an analysis of each security vulnerability addressed by a Critical Patch Update. The patch for CVE-2021-41165 also addresses CVE-2021-41164. The English text form of this Risk Matrix can be found here. Vulnerabilities affecting either Oracle Database or Oracle Fusion Middleware may affect Oracle Fusion Applications, so Oracle customers should refer to Oracle Fusion Applications Critical Patch Update Knowledge Document. Updated Siebel Applications versions and added couple of credit names, 11.3.2.2.0, 12.1.2.0.0, 12.1.0.1.0, 11.3.2.3.0, 11.3.2.1.0, Prior to 21.5.0.0.220118, Prior to 19.1.0.0.220118, Prior to 12.3.0.1, Oracle Secure Backup (Apache HTTP Server), TimesTen Infrastructure (Apache ZooKeeper), Content Acquisition System (Apache Commons Compress), Endeca Application Controller (Apache Tomcat), Content Acquisition System (Apache Commons IO), Inventory Organizer (Apache Commons Compress), Oracle Communications Cloud Native Core Policy, Binding Support Function (Spring Framework), Oracle Communications Cloud Native Core Security Edge Protection Proxy, Oracle Communications Cloud Native Core Service Communication Proxy, Oracle Communications Cloud Native Core Unified Data Repository, Virtual Network Function Manager, API Gateway (Apache Log4j), Oracle Communications Cloud Native Core Console, Signaling Engine, Media Engine (Apache Log4j), Platform, Data Persistence (OWASP Java HTML Sanitizer), Primavera P6 Enterprise Project Portfolio Management, 17.12.0.0-17.12.20.0, 18.8.0.0-18.8.24.0, 19.12.0.0-19.12.17.0, 20.12.0.0-20.12.9.0, Primavera P6 Professional Project Management, Platform,Data Access,Data Persistence (JDBC), 17.12.0-17.12.11, 18.8.0-18.8.13, 19.12.0-19.12.12, 20.12.0-20.12.7, 21.12.0, 19.12.0.0-19.12.18.0, 20.12.0.0-20.12.12.0, 21.12.0.0, 18.0.0.0-18.0.3.0, 19.0.0.0-19.0.1.2, 20.0.0.0, 20.0.0.1, Event Streams and Communications (Apache Kafka), 18.0.0.0-18.0.3.0, 19.0.0.0-19.0.1.2, 20.0.0.0, Oracle Banking Deposits and Lines of Credit Servicing, Oracle Banking Enterprise Default Management, 2.3.0-2.4.1, 2.6.2, 2.7.1, 2.10.0, 2.12.0, Oracle Financial Services Foreign Account Tax Compliance Act Management, 12.0.4, 12.1.0, 12.3.0, 12.4.0, 14.4.0, 14.5.0, Installer & Configuration (Apache Commons IO), Oracle Business Intelligence Enterprise Edition, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0, Centralized Third-party Jars (JDBC, OCCI, ODP for .NET), 5.5.0.0.0, 5.9.0.0.0, 12.2.1.3.0, 12.2.1.4.0, Centralized Thirdparty Jars (Apache Log4j), Web Services (JBoss Enterprise Application Platform), Oracle Health Sciences Clinical Development Analytics, Installation and Configuration (JDBC, ODP for .NET), Oracle Health Sciences Information Manager, 7.3.0.0-7.3.0.2, 8.0.0-8.0.2, 8.1.0-8.1.1, Oracle Hyperion Infrastructure Technology, Installation and Configuration (JDBC, OCCI, ODP for .NET), Oracle Insurance Policy Administration J2EE, Oracle Insurance Insbridge Rating and Underwriting, Framework Administrator IBFA (JDBC, ODP for .NET), Oracle GraalVM Enterprise Edition: 20.3.4, 21.3.0, Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle Java SE: 7u321, 8u311; Oracle GraalVM Enterprise Edition: 20.3.4, 21.3.0, Oracle Java SE: 7u321, 8u311, 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4, 21.3.0, Oracle Java SE: 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4, 21.3.0, Oracle Java SE: 7u321, 8u311, 11.0.13; Oracle GraalVM Enterprise Edition: 20.3.4, 21.3.0, 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior, 8.0.27 and prior, 7.5.24 and prior, 7.6.20 and prior, 8.0.27 and prior, PeopleSoft Enterprise CS SA Integration Pack, Order Broker Foundation (Apache Velocity Engine), Oracle Retail Predictive Application Server, Oracle Retail Customer Management and Segmentation Foundation, 14.1.3.0, 14.1.3.2, 15.0.3.1, 16.0.1-16.0.3, 19.0.0, 19.0.1, System Administration (Apache Commons IO), Agile Product Lifecycle Management Integration Pack for Oracle E-Business Suite, Oracle ZFS Storage Application Integration Engineering Software, Fujitsu M10-1, M10-4, M10-4S, M12-1, M12-2, M12-2S Servers, 4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0-4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0, 4.2.0.3.0, 4.3.0.1.0-4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This Critical Patch Update contains 1 new security patch for Oracle Airlines Data Model. Until you apply the Critical Patch Update patches, it may be possible to reduce the risk of successful attack by blocking network protocols required by an attack. Security vulnerabilities addressed by this Critical Patch Update affect the products listed below. This Critical Patch Update contains 78 new security patches for Oracle MySQL. The patch for CVE-2021-42340 also addresses CVE-2021-33037. This vulnerability is remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The patch for CVE-2021-31812 also addresses CVE-2021-31811. The patch for CVE-2021-23337 also addresses CVE-2020-28500. The patch for CVE-2021-22946 also addresses CVE-2021-22947. Workload Manager (Jetty): CVE-2021-28165, CVE-2021-28169 and CVE-2021-34428. 1 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The patch for CVE-2021-28164 also addresses CVE-2021-28163. We could not find a match for your search. For more information, see Oracle vulnerability disclosure policies. This Critical Patch Update contains 1 new security patch for Oracle Communications Data Model. This vulnerability is remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The patch for CVE-2021-39153 also addresses CVE-2021-39139, CVE-2021-39141, CVE-2021-39144, CVE-2021-39145, CVE-2021-39146, CVE-2021-39147, CVE-2021-39148, CVE-2021-39149, CVE-2021-39150, CVE-2021-39151, CVE-2021-39152 and CVE-2021-39154. Risk matrices for previous security patches can be found in previous Critical Patch Update advisories and Alerts. This vulnerability is not remotely exploitable without authentication, i.e., may not be exploited over a network without requiring user credentials. This vulnerability is not remotely exploitable without authentication, i.e., may not be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here. The English text form of this Risk Matrix can be found here.

For customers that have skipped one or more Critical Patch Updates and are concerned about products that do not have security patches announced in this Critical Patch Update, please review previous Critical Patch Update advisories to determine appropriate actions. This Critical Patch Update contains 48 new security patches for Oracle Financial Services Applications. Oracle Spatial and Graph (Apache Log4j): CVE-2021-45105. These patches address vulnerabilities in Oracle code and in third-party components included in Oracle products.

Compare & Book

Cheap Flights, Trains, Buses and more