CVE-2023-34363

An issue was discovered in Progress DataDirect Connect for ODBC before 08.02.2770 for Oracle. When using Oracle Advanced Security (OAS) encryption, if an error is encountered initializing the encryption object used to encrypt data, the code falls back to a different encryption mechanism that uses an insecure random number generator to generate the private key. It is possible for a well-placed attacker to predict the output of this random number generator, which could lead to an attacker decrypting traffic between the driver and the database server. The vulnerability does not exist if SSL / TLS encryption is used.

• CWE-338
• CWE-338

• https://community.progress.com/s/article/Security-vulnerabilities-in-DataDirect-ODBC-Oracle-Wire-Protocol-driver-June-2023Vendor Advisory
• https://progress.comProduct
• https://community.progress.com/s/article/Security-vulnerabilities-in-DataDirect-ODBC-Oracle-Wire-Protocol-driver-June-2023Vendor Advisory
• https://progress.comProduct

Published

Jun 9, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-34357 Soar Cloud Ltd. HR Portal has a weak Password Recovery Mech…7.8
• CVE-2023-34358ASUS RT-AX88U's httpd is subject to an unauthenticated DoS c…7.5
• CVE-2023-34359ASUS RT-AX88U's httpd is subject to an unauthenticated DoS c…7.5
• CVE-2023-3436Xpdf 4.04 will deadlock on a PDF object stream whose "Length…3.3
• CVE-2023-34360A stored cross-site scripting (XSS) issue was discovered wit…5.4
• CVE-2023-34362In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1…9.8
• CVE-2023-34364A buffer overflow was discovered in Progress DataDirect Conn…9.8
• CVE-2023-34365A stack-based buffer overflow vulnerability exists in the li…9.8
• CVE-2023-34366A use-after-free vulnerability exists in the Figure stream p…7.8
• CVE-2023-34367Windows 7 is vulnerable to a full blind TCP/IP hijacking att…6.5
• CVE-2023-34368Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabili…4.8
• CVE-2023-34369Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabili…4.8