CVE-2021-35567

CWE-863 — Incorrect Authorization8 documents8 sources
Severity
6.8MEDIUM
EPSS
0.2%
top 55.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
8
Netapp E-series Santricity OS ControllerOracle Corporation Java SE JDK AND JREDebian Debian Linux+5 more
Timeline
PublishedOct 20
Latest updateMay 24

Description

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via Kerberos to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerabil…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:NExploitability: 2.3 | Impact: 4.0

Affected Packages8 packages

▶NVDoracle/graalvm20.3.3, 21.2.0+1
▶NVDoracle/jdk1.8.0, 11.0.12, 17+2
▶NVDoracle/jre1.8.0, 11.0.12, 17+2
▶NVDoracle/openjdk31 versions+30

Also affects: Debian Linux 10.0, 11.0, 9.0, Fedora 33, 34, 35

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-c9cq-84w8-7r7f: Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)↗2022-05-24
▶
CVEList
CVE-2021-35567: Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)↗2021-10-20
▶
OSV
CVE-2021-35567: Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)↗2021-10-20
▶

📋Vendor Advisories

4
Ubuntu
OpenJDK vulnerabilities↗2021-12-17
▶
Red Hat
OpenJDK: Incorrect principal selection when using Kerberos Constrained Delegation (Libraries, 8266689)↗2021-10-19
▶
Oracle
Oracle Oracle Java SE Risk Matrix: Libraries — CVE-2021-35567↗2021-10-15
▶
Debian
CVE-2021-35567: openjdk-11 - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracl...↗2021
▶
CVE-2021-35567 (MEDIUM CVSS 6.8) | Vulnerability in the Java SE | cvebase.io