CVE-2021-2341 — Sensitive Information Exposure in Corporation Java SE JDK AND JRE

CWE-200 — Sensitive Information Exposure9 documents8 sources
Severity
3.1LOWNVD
EPSS
0.4%
top 40.62%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
Oracle Corporation Java SE JDK AND JREDebian LinuxFedoraproject Fedora+4 more
Timeline
PublishedJul 21
Latest updateMay 24

Description

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker…

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:NExploitability: 1.6 | Impact: 1.4

Affected Packages5 packages

▶NVDoracle/graalvm20.3.2, 21.1.0+1
▶NVDoracle/jdk4 versions+3
▶NVDoracle/jre4 versions+3
▶NVDoracle/openjdk28 versions+27

Also affects: Debian Linux 10.0, 9.0, Fedora 33, 34

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

4
GHSA
GHSA-w2ph-9hg3-84vp: Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking)↗2022-05-24
▶
OSV
openjdk-8, openjdk-lts vulnerabilities↗2021-12-17
▶
OSV
CVE-2021-2341: Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking)↗2021-07-21
▶
CVEList
CVE-2021-2341: Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking)↗2021-07-20
▶

📋Vendor Advisories

4
Ubuntu
OpenJDK vulnerabilities↗2021-12-17
▶
Red Hat
OpenJDK: FTP PASV command response can cause FtpClient to connect to arbitrary host (Networking, 8258432)↗2021-07-20
▶
Oracle
Oracle Oracle Java SE Risk Matrix: Networking — CVE-2021-2341↗2021-07-15
▶
Debian
CVE-2021-2341: openjdk-11 - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracl...↗2021
▶
CVE-2021-2341 — Sensitive Information Exposure | cvebase