CVE-2021-2388 — Incorrect Comparison in Corporation Java SE JDK AND JRE

CWE-697 — Incorrect Comparison8 documents8 sources
Severity
7.5HIGHNVD
EPSS
0.8%
top 25.83%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Oracle Corporation Java SE JDK AND JREDebian LinuxOracle Graalvm+3 more
Timeline
PublishedJul 21
Latest updateMay 24

Description

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successf…

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.6 | Impact: 5.9

Affected Packages5 packages

▶NVDoracle/graalvm20.3.2, 21.1.0+1
▶NVDoracle/jdk1.8.0, 11.0.11, 16.0.1+2
▶NVDoracle/jre1.8.0, 11.0.11, 16.0.1+2
▶NVDoracle/openjdk27 versions+26

Also affects: Debian Linux 10.0, 9.0

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-4h93-46mq-wpq9: Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot)↗2022-05-24
▶
OSV
CVE-2021-2388: Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot)↗2021-07-21
▶
CVEList
CVE-2021-2388: Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot)↗2021-07-20
▶

📋Vendor Advisories

4
Ubuntu
OpenJDK vulnerabilities↗2021-12-17
▶
Red Hat
OpenJDK: Incorrect comparison during range check elimination (Hotspot, 8264066)↗2021-07-20
▶
Oracle
Oracle Oracle Java SE Risk Matrix: Hotspot — CVE-2021-2388↗2021-07-15
▶
Debian
CVE-2021-2388: openjdk-11 - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracl...↗2021
▶
CVE-2021-2388 — Incorrect Comparison | cvebase