The Patching Friars' AlmanacA calendar of CVE saints

Patron of June 16

BigDebITHoly card for bigdebit, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 DAREAVERE BigDebIT DEBET ET HABET
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint BigDebIT, Who Laid Hands on the Ledger

Patron of accountants, ERP systems never updated, and balance sheets that add up a little too well.

Life

On 16 June 2020 Onapsis disclosed BigDebIT, two vulnerabilities (CVE-2020-2586 and CVE-2020-2587) in the Hierarchy Diagrammer component of Oracle E-Business Suite, scored 9.9. An attacker with no credentials could reach the General Ledger and alter financial records, getting around the controls that audited accounts depend on. Oracle had fixed them in January, but according to the researchers more than half of customers had yet to apply the patch.

Prayer

O Saint BigDebIT, keeper of debit and credit, keep stranger hands off our ledgers and let the books balance for the right reasons. Amen.

How to celebrate

Celebrated by applying Oracle's Critical Patch Updates every quarter, not every five years.

A patch put off is a ledger touched up.

Technical record

Disclosed on
June 16 2020
CVE
CVE-2020-2586CVE-2020-2587
CVSS
9.9
Product
Oracle Corporation · Human Resources

Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Hierarchy Diagrammers). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Human Resources. While the vulnerability is in Oracle Human Resources, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Human Resources accessible data as well as unauthorized access to critical data or complete access to all Oracle Human Resources accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Human Resources. CVSS 3.0 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L).

Sources: onapsis.com · web.archive.org

Canonized by Pope Zerologon I

Related saints

Sharing the feast day

Same year: 2020

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.