🛡️ CVE-2023-34363
🟡 CVSS 5.9 — Medium ✅ No Known Exploit CWE-338 NVD
5.9
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

An issue was discovered in Progress DataDirect Connect for ODBC before 08.02.2770 for Oracle. When using Oracle Advanced Security (OAS) encryption, if an error is encountered initializing the encryption object used to encrypt data, the code falls back to a different encryption mechanism that uses an insecure random number generator to generate the private key. It is possible for a well-placed attacker to predict the output of this random number generator, which could lead to an attacker decrypting traffic between the driver and the database server. The vulnerability does not exist if SSL / TLS encryption is used.

Details

Severity MEDIUM
CVSS Score 5.9
CVSS Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE CWE-338
Public Exploit ✅ No
Source NVD
Published 2023-06-09
Updated 2026-06-08
Modified 2025-01-06
Fix URL N/A

Affected Packages

Software From version Fixed in
datadirect-odbc-oracle-wire-protocol-driver — 08.02.2770

Similar Threats

Site Security Check

Concerned your site may already be targeted?

BotEraser analyzes incoming traffic patterns and helps identify bot behavior consistent with known exploit attempts.

Check My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.