CVE-2021-2334 — Improper Input Validation in Corporation Database Enterprise Edition

CWE-20 — Improper Input ValidationCWE-125 — Out-of-bounds ReadCWE-120 — Classic Buffer Overflow5 documents5 sources
Severity
3.5LOWNVD
EPSS
0.2%
top 56.19%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Oracle Corporation Database Enterprise EditionOracle Database
Timeline
Latest updateJul 20
PublishedJul 21

Description

Vulnerability in the Oracle Database - Enterprise Edition Data Redaction component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise Oracle Database - Enterprise Edition Data Redaction. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerabilit…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:NExploitability: 2.1 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5oracle_corporation/database_enterprise_edition12.1.0.2, 12.2.0.1, 19c+2
▶NVDoracle/database12.1.0.2, 12.2.0.1, 19c+2

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

1
CVEList
CVE-2021-2334: Vulnerability in the Oracle Database - Enterprise Edition Data Redaction component of Oracle Database Server↗2021-07-20
▶

📋Vendor Advisories

3
Oracle
Oracle Oracle Database Server Risk Matrix: Oracle Database - Enterprise Edition Data Redaction — CVE-2021-2334↗2021-07-15
▶
Microsoft
Buffer overflow vulnerability in libsolv 2020-12-13 via the Solver * testcase_read(Pool *pool FILE *fp const char *testcase Queue *job char **resultp int *resultflagsp function at src/testcase.c: line↗2021-05-11
▶
Red Hat
libsolv: heap-based buffer overflow in testcase_read() in src/testcase.c↗2020-12-13
▶
CVE-2021-2334 — Improper Input Validation | cvebase