CVE-2021-2369 — Improper Verification of Cryptographic Signature in Corporation Java SE JDK AND JRE

CWE-347 — Improper Verification of Cryptographic Signature9 documents8 sources
Severity
4.3MEDIUMNVD
EPSS
0.3%
top 43.18%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Oracle Corporation Java SE JDK AND JREDebian LinuxOracle Graalvm+3 more
Timeline
PublishedJul 21
Latest updateMay 24

Description

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Library). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Suc…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages5 packages

▶NVDoracle/graalvm20.3.2, 21.1.0+1
▶NVDoracle/jdk4 versions+3
▶NVDoracle/jre4 versions+3
▶NVDoracle/openjdk28 versions+27

Also affects: Debian Linux 10.0, 9.0

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

4
GHSA
GHSA-f45f-qwp3-mp29: Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Library)↗2022-05-24
▶
OSV
openjdk-8, openjdk-lts vulnerabilities↗2021-12-17
▶
OSV
CVE-2021-2369: Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Library)↗2021-07-21
▶
CVEList
CVE-2021-2369: Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Library)↗2021-07-20
▶

📋Vendor Advisories

4
Ubuntu
OpenJDK vulnerabilities↗2021-12-17
▶
Red Hat
OpenJDK: Incorrect verification of JAR files with multiple MANIFEST.MF files (Library, 8260967)↗2021-07-20
▶
Oracle
Oracle Oracle Java SE Risk Matrix: Library — CVE-2021-2369↗2021-07-15
▶
Debian
CVE-2021-2369: openjdk-11 - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracl...↗2021
▶
CVE-2021-2369 — MEDIUM severity | cvebase