[
  {
    "advisoryKey": "oracle/cpuapr2024-01-html",
    "affectedPackages": [
      {
        "identifier": "Oracle GraalVM for JDK::Libraries",
        "platform": "Libraries",
        "provenance": [
          {
            "fieldMask": [],
            "kind": "affected",
            "recordedAt": "2024-04-18T00:01:00+00:00",
            "source": "vndr-oracle",
            "value": "Oracle GraalVM for JDK::Libraries"
          }
        ],
        "statuses": [],
        "type": "vendor",
        "versionRanges": [
          {
            "fixedVersion": null,
            "introducedVersion": null,
            "lastAffectedVersion": null,
            "primitives": {
              "evr": null,
              "hasVendorExtensions": true,
              "nevra": null,
              "semVer": null,
              "vendorExtensions": {
                "oracle.product": "Oracle GraalVM for JDK",
                "oracle.productRaw": "Oracle Java SE, Oracle GraalVM for JDK",
                "oracle.component": "Libraries",
                "oracle.componentRaw": "Libraries",
                "oracle.segmentVersions": "21.3.8, 22.0.0",
                "oracle.supportedVersions": "Oracle Java SE: 8u401, 11.0.22; Oracle GraalVM for JDK: 21.3.8, 22.0.0",
                "oracle.rangeExpression": "21.3.8, 22.0.0 (notes: See Note A for mitigation)",
                "oracle.baseExpression": "21.3.8, 22.0.0",
                "oracle.notes": "See Note A for mitigation",
                "oracle.versionTokens": "21.3.8|22.0.0",
                "oracle.versionTokens.normalized": "21.3.8|22.0.0"
              }
            },
            "provenance": {
              "fieldMask": [],
              "kind": "range",
              "recordedAt": "2024-04-18T00:01:00+00:00",
              "source": "vndr-oracle",
              "value": "Oracle GraalVM for JDK::Libraries"
            },
            "rangeExpression": "21.3.8, 22.0.0 (notes: See Note A for mitigation)",
            "rangeKind": "vendor"
          }
        ]
      },
      {
        "identifier": "Oracle Java SE::Hotspot",
        "platform": "Hotspot",
        "provenance": [
          {
            "fieldMask": [],
            "kind": "affected",
            "recordedAt": "2024-04-18T00:01:00+00:00",
            "source": "vndr-oracle",
            "value": "Oracle Java SE::Hotspot"
          }
        ],
        "statuses": [],
        "type": "vendor",
        "versionRanges": [
          {
            "fixedVersion": "8u401",
            "introducedVersion": null,
            "lastAffectedVersion": null,
            "primitives": {
              "evr": null,
              "hasVendorExtensions": true,
              "nevra": null,
              "semVer": null,
              "vendorExtensions": {
                "oracle.product": "Oracle Java SE",
                "oracle.productRaw": "Oracle Java SE",
                "oracle.component": "Hotspot",
                "oracle.componentRaw": "Hotspot",
                "oracle.segmentVersions": "Oracle Java SE: 8u401, 11.0.22",
                "oracle.supportedVersions": "Oracle Java SE: 8u401, 11.0.22",
                "oracle.rangeExpression": "Oracle Java SE: 8u401, 11.0.22 (notes: Fixed in 8u401 Patch 123456)",
                "oracle.baseExpression": "Oracle Java SE: 8u401, 11.0.22",
                "oracle.notes": "Fixed in 8u401 Patch 123456",
                "oracle.fixedVersion": "8u401",
                "oracle.patchNumber": "123456",
                "oracle.versionTokens": "Oracle Java SE: 8u401|11.0.22",
                "oracle.versionTokens.normalized": "11.0.22"
              }
            },
            "provenance": {
              "fieldMask": [],
              "kind": "range",
              "recordedAt": "2024-04-18T00:01:00+00:00",
              "source": "vndr-oracle",
              "value": "Oracle Java SE::Hotspot"
            },
            "rangeExpression": "Oracle Java SE: 8u401, 11.0.22 (notes: Fixed in 8u401 Patch 123456)",
            "rangeKind": "vendor"
          }
        ]
      },
      {
        "identifier": "Oracle Java SE::Libraries",
        "platform": "Libraries",
        "provenance": [
          {
            "fieldMask": [],
            "kind": "affected",
            "recordedAt": "2024-04-18T00:01:00+00:00",
            "source": "vndr-oracle",
            "value": "Oracle Java SE::Libraries"
          }
        ],
        "statuses": [],
        "type": "vendor",
        "versionRanges": [
          {
            "fixedVersion": null,
            "introducedVersion": null,
            "lastAffectedVersion": null,
            "primitives": {
              "evr": null,
              "hasVendorExtensions": true,
              "nevra": null,
              "semVer": null,
              "vendorExtensions": {
                "oracle.product": "Oracle Java SE",
                "oracle.productRaw": "Oracle Java SE, Oracle GraalVM for JDK",
                "oracle.component": "Libraries",
                "oracle.componentRaw": "Libraries",
                "oracle.segmentVersions": "8u401, 11.0.22",
                "oracle.supportedVersions": "Oracle Java SE: 8u401, 11.0.22; Oracle GraalVM for JDK: 21.3.8, 22.0.0",
                "oracle.rangeExpression": "8u401, 11.0.22 (notes: See Note A for mitigation)",
                "oracle.baseExpression": "8u401, 11.0.22",
                "oracle.notes": "See Note A for mitigation",
                "oracle.versionTokens": "8u401|11.0.22",
                "oracle.versionTokens.normalized": "11.0.22"
              }
            },
            "provenance": {
              "fieldMask": [],
              "kind": "range",
              "recordedAt": "2024-04-18T00:01:00+00:00",
              "source": "vndr-oracle",
              "value": "Oracle Java SE::Libraries"
            },
            "rangeExpression": "8u401, 11.0.22 (notes: See Note A for mitigation)",
            "rangeKind": "vendor"
          }
        ]
      }
    ],
    "aliases": [
      "CVE-2024-9000",
      "CVE-2024-9001",
      "ORACLE:CPUAPR2024-01-HTML"
    ],
    "cvssMetrics": [],
    "exploitKnown": false,
    "language": "en",
    "modified": null,
    "provenance": [
      {
        "fieldMask": [],
        "kind": "document",
        "recordedAt": "2024-04-18T00:00:00+00:00",
        "source": "vndr-oracle",
        "value": "https://www.oracle.com/security-alerts/cpuapr2024-01.html"
      },
      {
        "fieldMask": [],
        "kind": "mapping",
        "recordedAt": "2024-04-18T00:01:00+00:00",
        "source": "vndr-oracle",
        "value": "cpuapr2024-01-html"
      }
    ],
    "published": "2024-04-18T12:30:00+00:00",
    "references": [
      {
        "kind": "reference",
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2024-04-18T00:01:00+00:00",
          "source": "vndr-oracle",
          "value": "https://support.oracle.com/kb/123456"
        },
        "sourceTag": null,
        "summary": null,
        "url": "https://support.oracle.com/kb/123456"
      },
      {
        "kind": "patch",
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2024-04-18T00:01:00+00:00",
          "source": "vndr-oracle",
          "value": "https://support.oracle.com/rs?type=doc&id=3010001.1"
        },
        "sourceTag": "oracle",
        "summary": "Oracle Java SE",
        "url": "https://support.oracle.com/rs?type=doc&id=3010001.1"
      },
      {
        "kind": "patch",
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2024-04-18T00:01:00+00:00",
          "source": "vndr-oracle",
          "value": "https://support.oracle.com/rs?type=doc&id=3010002.1"
        },
        "sourceTag": "oracle",
        "summary": "Oracle GraalVM",
        "url": "https://support.oracle.com/rs?type=doc&id=3010002.1"
      },
      {
        "kind": "reference",
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2024-04-18T00:01:00+00:00",
          "source": "vndr-oracle",
          "value": "https://updates.oracle.com/patches/fullpatch"
        },
        "sourceTag": null,
        "summary": null,
        "url": "https://updates.oracle.com/patches/fullpatch"
      },
      {
        "kind": "advisory",
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2024-04-18T00:01:00+00:00",
          "source": "vndr-oracle",
          "value": "https://www.cve.org/CVERecord?id=CVE-2024-9000"
        },
        "sourceTag": "CVE-2024-9000",
        "summary": null,
        "url": "https://www.cve.org/CVERecord?id=CVE-2024-9000"
      },
      {
        "kind": "advisory",
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2024-04-18T00:01:00+00:00",
          "source": "vndr-oracle",
          "value": "https://www.cve.org/CVERecord?id=CVE-2024-9001"
        },
        "sourceTag": "CVE-2024-9001",
        "summary": null,
        "url": "https://www.cve.org/CVERecord?id=CVE-2024-9001"
      },
      {
        "kind": "advisory",
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2024-04-18T00:01:00+00:00",
          "source": "vndr-oracle",
          "value": "https://www.oracle.com/security-alerts/cpuapr2024-01.html"
        },
        "sourceTag": "oracle",
        "summary": "cpuapr2024 01 html",
        "url": "https://www.oracle.com/security-alerts/cpuapr2024-01.html"
      }
    ],
    "severity": null,
    "summary": "Oracle CPU April 2024 Advisory 1 Oracle Critical Patch Update Advisory - April 2024 (CPU01) This advisory addresses vulnerabilities in Oracle Java SE and Oracle GraalVM for JDK. It references CVE-2024-9000 and CVE-2024-9001 with additional remediation steps. Affected Products and Versions Patch Availability Document Oracle Java SE, versions 8u401, 11.0.22 Oracle Java SE Oracle GraalVM for JDK, versions 21.3.8, 22.0.0 Oracle GraalVM CVE ID Product Component Protocol Remote Exploit without Auth.? Base Score Attack Vector Attack Complex Privs Req'd User Interact Scope Confidentiality Integrity Availability Supported Versions Affected Notes CVE-2024-9000 Oracle Java SE Hotspot Multiple Yes 9.8 Network Low None Required Changed High High High Oracle Java SE: 8u401, 11.0.22 Fixed in 8u401 Patch 123456 CVE-2024-9001 Oracle Java SE, Oracle GraalVM for JDK Libraries Multiple Yes 7.5 Network High None Required Changed Medium Medium Medium Oracle Java SE: 8u401, 11.0.22; Oracle GraalVM for JDK: 21.3.8, 22.0.0 See Note A for mitigation Note A: Apply interim update 22.0.0.1 for GraalVM. Patch download Support article",
    "title": "cpuapr2024 01 html"
  },
  {
    "advisoryKey": "oracle/cpuapr2024-02-html",
    "affectedPackages": [
      {
        "identifier": "Oracle Database Server::SQL*Plus",
        "platform": "SQL*Plus",
        "provenance": [
          {
            "fieldMask": [],
            "kind": "affected",
            "recordedAt": "2024-04-18T00:01:00+00:00",
            "source": "vndr-oracle",
            "value": "Oracle Database Server::SQL*Plus"
          }
        ],
        "statuses": [],
        "type": "vendor",
        "versionRanges": [
          {
            "fixedVersion": null,
            "introducedVersion": null,
            "lastAffectedVersion": null,
            "primitives": {
              "evr": null,
              "hasVendorExtensions": true,
              "nevra": null,
              "semVer": null,
              "vendorExtensions": {
                "oracle.product": "Oracle Database Server",
                "oracle.productRaw": "Oracle Database Server",
                "oracle.component": "SQL*Plus",
                "oracle.componentRaw": "SQL*Plus",
                "oracle.segmentVersions": "Oracle Database Server: 19c, 21c",
                "oracle.supportedVersions": "Oracle Database Server: 19c, 21c",
                "oracle.rangeExpression": "Oracle Database Server: 19c, 21c (notes: See Note B)",
                "oracle.baseExpression": "Oracle Database Server: 19c, 21c",
                "oracle.notes": "See Note B",
                "oracle.versionTokens": "Oracle Database Server: 19c|21c"
              }
            },
            "provenance": {
              "fieldMask": [],
              "kind": "range",
              "recordedAt": "2024-04-18T00:01:00+00:00",
              "source": "vndr-oracle",
              "value": "Oracle Database Server::SQL*Plus"
            },
            "rangeExpression": "Oracle Database Server: 19c, 21c (notes: See Note B)",
            "rangeKind": "vendor"
          }
        ]
      },
      {
        "identifier": "Oracle WebLogic Server::Console",
        "platform": "Console",
        "provenance": [
          {
            "fieldMask": [],
            "kind": "affected",
            "recordedAt": "2024-04-18T00:01:00+00:00",
            "source": "vndr-oracle",
            "value": "Oracle WebLogic Server::Console"
          }
        ],
        "statuses": [],
        "type": "vendor",
        "versionRanges": [
          {
            "fixedVersion": "99999999",
            "introducedVersion": null,
            "lastAffectedVersion": null,
            "primitives": {
              "evr": null,
              "hasVendorExtensions": true,
              "nevra": null,
              "semVer": null,
              "vendorExtensions": {
                "oracle.product": "Oracle WebLogic Server",
                "oracle.productRaw": "Oracle WebLogic Server",
                "oracle.component": "Console",
                "oracle.componentRaw": "Console",
                "oracle.segmentVersions": "Oracle WebLogic Server: 14.1.1.0.0",
                "oracle.supportedVersions": "Oracle WebLogic Server: 14.1.1.0.0",
                "oracle.rangeExpression": "Oracle WebLogic Server: 14.1.1.0.0 (notes: Patch 99999999 available)",
                "oracle.baseExpression": "Oracle WebLogic Server: 14.1.1.0.0",
                "oracle.notes": "Patch 99999999 available",
                "oracle.fixedVersion": "99999999",
                "oracle.patchNumber": "99999999",
                "oracle.versionTokens": "Oracle WebLogic Server: 14.1.1.0.0"
              }
            },
            "provenance": {
              "fieldMask": [],
              "kind": "range",
              "recordedAt": "2024-04-18T00:01:00+00:00",
              "source": "vndr-oracle",
              "value": "Oracle WebLogic Server::Console"
            },
            "rangeExpression": "Oracle WebLogic Server: 14.1.1.0.0 (notes: Patch 99999999 available)",
            "rangeKind": "vendor"
          }
        ]
      }
    ],
    "aliases": [
      "CVE-2024-9100",
      "CVE-2024-9101",
      "ORACLE:CPUAPR2024-02-HTML"
    ],
    "cvssMetrics": [],
    "exploitKnown": false,
    "language": "en",
    "modified": null,
    "provenance": [
      {
        "fieldMask": [],
        "kind": "document",
        "recordedAt": "2024-04-18T00:00:00+00:00",
        "source": "vndr-oracle",
        "value": "https://www.oracle.com/security-alerts/cpuapr2024-02.html"
      },
      {
        "fieldMask": [],
        "kind": "mapping",
        "recordedAt": "2024-04-18T00:01:00+00:00",
        "source": "vndr-oracle",
        "value": "cpuapr2024-02-html"
      }
    ],
    "published": "2024-04-19T08:15:00+00:00",
    "references": [
      {
        "kind": "reference",
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2024-04-18T00:01:00+00:00",
          "source": "vndr-oracle",
          "value": "https://support.oracle.com/kb/789012"
        },
        "sourceTag": null,
        "summary": null,
        "url": "https://support.oracle.com/kb/789012"
      },
      {
        "kind": "patch",
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2024-04-18T00:01:00+00:00",
          "source": "vndr-oracle",
          "value": "https://support.oracle.com/rs?type=doc&id=3010100.1"
        },
        "sourceTag": "oracle",
        "summary": "Fusion Middleware",
        "url": "https://support.oracle.com/rs?type=doc&id=3010100.1"
      },
      {
        "kind": "patch",
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2024-04-18T00:01:00+00:00",
          "source": "vndr-oracle",
          "value": "https://support.oracle.com/rs?type=doc&id=3010101.1"
        },
        "sourceTag": "oracle",
        "summary": "Database",
        "url": "https://support.oracle.com/rs?type=doc&id=3010101.1"
      },
      {
        "kind": "advisory",
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2024-04-18T00:01:00+00:00",
          "source": "vndr-oracle",
          "value": "https://www.cve.org/CVERecord?id=CVE-2024-9100"
        },
        "sourceTag": "CVE-2024-9100",
        "summary": null,
        "url": "https://www.cve.org/CVERecord?id=CVE-2024-9100"
      },
      {
        "kind": "advisory",
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2024-04-18T00:01:00+00:00",
          "source": "vndr-oracle",
          "value": "https://www.cve.org/CVERecord?id=CVE-2024-9101"
        },
        "sourceTag": "CVE-2024-9101",
        "summary": null,
        "url": "https://www.cve.org/CVERecord?id=CVE-2024-9101"
      },
      {
        "kind": "advisory",
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2024-04-18T00:01:00+00:00",
          "source": "vndr-oracle",
          "value": "https://www.oracle.com/security-alerts/cpuapr2024-02.html"
        },
        "sourceTag": "oracle",
        "summary": "cpuapr2024 02 html",
        "url": "https://www.oracle.com/security-alerts/cpuapr2024-02.html"
      }
    ],
    "severity": null,
    "summary": "Oracle CPU April 2024 Advisory 2 Oracle Security Alert Advisory - April 2024 (CPU02) Mitigations for Oracle WebLogic Server and Oracle Database Server. Includes references to CVE-2024-9100 with additional product components. Affected Products and Versions Patch Availability Document Oracle WebLogic Server, versions 14.1.1.0.0 Fusion Middleware Oracle Database Server, versions 19c, 21c Database CVE ID Product Component Protocol Remote Exploit without Auth.? Base Score Attack Vector Attack Complex Privs Req'd User Interact Scope Confidentiality Integrity Availability Supported Versions Affected Notes CVE-2024-9100 Oracle WebLogic Server Console HTTP Yes 8.1 Network Low Low Required Changed High High High Oracle WebLogic Server: 14.1.1.0.0 Patch 99999999 available CVE-2024-9101 Oracle Database Server SQL*Plus Multiple No 5.4 Local Low Low None Unchanged Medium Low Low Oracle Database Server: 19c, 21c See Note B Note B: Customers should review Support Doc 3010101.1 for mitigation guidance. More details at Support KB .",
    "title": "cpuapr2024 02 html"
  }
]