Critical Vulnerabilities in Toad for Oracle 2025 R1

Toad for Oracle & DevOps Toolkit
1

The 2025 RC1 has the following Vulnerabilities.

image
image1886×1046 90.5 KB

Please can you let me know what version to install to resolve them

Regards

Denis

2

2026 R2 is the most recent release and it resolves all known CVE at time of production for modules we (Toad for Oracle team) produce. Guava and Gson have been updated and are CVE-free for sure. Similarly .NET packages have all been updated. Our Mend scans were clean, 0 vulnerabilities of any severity, when 2026 R2 was built. You should upgrade and scan it.

Also, SQLitePCLRaw.lib.e_sqlite3 is a false flag in your tool. We've seen this come up.... a lot. It is the interface into the SQLite database engine, which is vulnerable in 2025 R1 and has been resolved; however, SQLitePCLRaw.lib.e_sqlite3 is not vulnerable despite many scanning tools flagging it.

What are you scanning? Did you scan the .exe installer that bundles other Quest products in addition to Toad or did you only scan Toad's MSI and/or its installation folder?

Michael

3

I have updated the Install to 2026 R2 and the 12 Vulnerabilities are no longer there.

A new one as appeared, related to .net 8.0.28

image
image1809×376 33.8 KB

I am scanning the install folder to create the SBOM of the DLLs found there
The scan tool is Owasp Dependency Tracker

This is the current score for 2026 R2

image
image1830×383 32.1 KB

image
image1771×600 50.3 KB

4

Can you tell me which module(s) are causing that .NET 8 CVE to flag?

Michael

5

I should clarify my last message. I can see the component in the screenshot that is triggering it, but I wasn't sure if you had the full file path(s) to the affected files in your results there.

6

Hi Michael

Ill attach the SBOM for you.

It seems that the Toad.Host.Ai package has a reference to runtimepack.Microsoft.NETCore.App.Runtime.win-x64 8.0.28

{

        "ref": "pkg:nuget/Toad.Host.Ai@1.0.0.46140?package-id=4da4e0e5a1b0f52c",

        "dependsOn": \[

            "pkg:nuget/Azure.AI.OpenAI@2.9.0-beta.1?package-id=4f46269a819ac6f5",

            "pkg:nuget/Azure.Identity@1.20.0?package-id=d68bdb2f94480a68",

            "pkg:nuget/Microsoft.Agents.AI.OpenAI@1.0.0?package-id=bfcce63c57df3818",

            "pkg:nuget/Microsoft.Agents.AI@1.0.0?package-id=4ff00c818ed9f81c",

            "pkg:nuget/ModelContextProtocol@1.2.0?package-id=5301d47aaf439db3",

            "pkg:nuget/Newtonsoft.Json@13.0.4?package-id=2c3e74876e8a2421",

            "pkg:nuget/Quest.Reactive@3.0.0.151?package-id=cded3632952ecfd0",

            "pkg:nuget/Toad.Shared.Ai.Reference@1.0.0.0?package-id=267a90f2ecf7a919",

            "pkg:nuget/runtimepack.Microsoft.AspNetCore.App.Runtime.win-x64@8.0.28?package-id=3559a76ce4010f98",

            "pkg:nuget/runtimepack.Microsoft.NETCore.App.Runtime.win-x64@8.0.28?package-id=8abf2d176da5e667"

        \]

    }
7

Excellent, thank you. I will log this.

Michael