erroneo.us
Search all guides⌘K

Digest · Tuesday

Security digest: April 18, 2017

1 editorial brief.

All digests · RSS · Markdown

Take stock

  • Check exposure: Oracle WebLogic CVE-2017-3506: 2017 WLS-WSAT Bug in KEV. Anyone running Oracle WebLogic Server 10.3.6.0, 12.1.3.0 or 12.2.1.0 to 12.2.1.2, alone or inside another product, especially with the server's HTTP port reachable from the internet.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2017-3506

Oracle WebLogic CVE-2017-3506: 2017 WLS-WSAT Bug in KEV

Patched WebLogic is fine; any server still on a 2017-era release with /wls-wsat/ reachable is a cryptominer target and should be upgraded and checked for compromise.

Must act: Anyone running Oracle WebLogic Server 10.3.6.0, 12.1.3.0 or 12.2.1.0 to 12.2.1.2, alone or inside another product, especially with the server's HTTP port reachable from the internet.

Can relax: Teams on a supported WebLogic release (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 or 15.1.1.0.0) with current Critical Patch Updates applied.

  1. Inventory every WebLogic install, including ones bundled inside other products, and record its version and applied patches.
  2. Move anything on 10.3.6.0, 12.1.3.0 or 12.2.1.0 to 12.2.1.2 to a supported release and apply the October 2026 Critical Patch Update.
  3. Check whether /wls-wsat/ and /_async/ paths answer from the internet, and block them at the proxy if nothing uses them.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.