CVE-2021-2432
Summary
| CVE | CVE-2021-2432 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2021-07-21 15:16:00 UTC |
| Updated | 2022-09-23 14:24:00 UTC |
| Description | Vulnerability in the Java SE product of Oracle Java SE (component: JNDI). The supported version that is affected is Java SE: 7u301. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). |
Risk And Classification
Problem Types: NVD-CWE-noinfo
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Mcafee | Epolicy Orchestrator | All | All | All | All |
| Application | Mcafee | Epolicy Orchestrator | 5.10.0 | - | All | All |
| Application | Mcafee | Epolicy Orchestrator | 5.10.0 | update_1 | All | All |
| Application | Mcafee | Epolicy Orchestrator | 5.10.0 | update_10 | All | All |
| Application | Mcafee | Epolicy Orchestrator | 5.10.0 | update_2 | All | All |
| Application | Mcafee | Epolicy Orchestrator | 5.10.0 | update_3 | All | All |
| Application | Mcafee | Epolicy Orchestrator | 5.10.0 | update_4 | All | All |
| Application | Mcafee | Epolicy Orchestrator | 5.10.0 | update_5 | All | All |
| Application | Mcafee | Epolicy Orchestrator | 5.10.0 | update_6 | All | All |
| Application | Mcafee | Epolicy Orchestrator | 5.10.0 | update_7 | All | All |
| Application | Mcafee | Epolicy Orchestrator | 5.10.0 | update_8 | All | All |
| Application | Mcafee | Epolicy Orchestrator | 5.10.0 | update_9 | All | All |
| Application | Oracle | Jdk | 1.7.0 | update301 | All | All |
| Application | Oracle | Jdk | 1.7.0 | update_301 | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Oracle Critical Patch Update Advisory - July 2021 | MISC | www.oracle.com | |
| OpenJDK: Multiple Vulnerabilities (GLSA 202209-05) — Gentoo security | GENTOO | security.gentoo.org | |
| Security Bulletin - ePolicy Orchestrator update addresses two product vulnerabilities (CVE-2021-31834 and CVE-2021-31835) and updates Java, OpenSSL, and Tomcat | CONFIRM | kc.mcafee.com | |
| July 2021 Java Platform Standard Edition Vulnerabilities in NetApp Products | NetApp Product Security | CONFIRM | security.netapp.com | Third Party Advisory |
| Oracle Critical Patch Update Advisory - October 2021 | MISC | www.oracle.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 239588 Red Hat Update for java-1.7.1-ibm (RHSA-2021:3293)
- 296059 Oracle Solaris 11.4 Support Repository Update (SRU) 36.0.1.101.2 Missing (CPUJUL2021)
- 296060 Oracle Solaris 11.4 Support Repository Update (SRU) 37.0.1.101.1 Missing (CPUJUL2021)
- 330088 IBM AIX Java Multiple Vulnerabilities (java_sep2021_advisory)
- 375729 Oracle Java SE Critical Patch Update - July 2021 (CPUJUL2021)
- 375817 Azul Java Multiple Vulnerabilities Security Update July 2021
- 502145 Alpine Linux Security Update for openjdk7
- 710615 Gentoo Linux Open Java Development Toolkit (OpenJDK) Multiple Vulnerabilities (GLSA 202209-05)
- 751121 SUSE Enterprise Linux Security Update for java-1_7_0-openJava Development Toolkit (SUSE-SU-2021:3007-1)
- 751641 SUSE Enterprise Linux Security Update for java-1_7_1-ibm (SUSE-SU-2022:0166-1)
- 753215 SUSE Enterprise Linux Security Update for java-1_7_1-ibm (SUSE-SU-2022:14875-1)