CVE-2024-20995: 
Oracle Database Server vulnerability analysis and mitigation

A vulnerability has been identified in the Oracle Database Sharding component of Oracle Database Server, affecting versions 19.3-19.22 and 21.3-21.13. The vulnerability (CVE-2024-20995) requires a high-privileged attacker with DBA privileges and network access via Oracle Net to potentially compromise Oracle Database Sharding (Oracle Advisory).

The vulnerability has been assigned a CVSS 3.1 Base Score of 2.4 (Availability impacts) with the following vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:L. The attack requires network access (AV:N), is considered low complexity (AC:L), needs high privileges (PR:H), requires user interaction (UI:R), has unchanged scope (S:U), and only affects availability with low impact (A:L) (NVD).

Successful exploitation of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Database Sharding. The impact is limited to availability with no effects on confidentiality or integrity of the system (Oracle Advisory).

The vulnerability is considered easily exploitable but requires specific conditions: the attacker must have DBA privileges and network access via Oracle Net. Additionally, successful exploitation requires human interaction from a person other than the attacker (NVD).

Oracle has released patches for the affected versions (19.3-19.22 and 21.3-21.13) as part of the April 2024 Critical Patch Update. Oracle strongly recommends that customers apply the security patches as soon as possible (Oracle Advisory).