CVE-2021-2351CWE-327CWE-384

CVE-2021-2351

High · published July 21, 2021

CVSS v3.1
8.3
EPSS
2%
Percentile
84.1
In the wild
Unconfirmed
What it is

Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Advanced Networking Option, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Advanced Networking Option. Note: The July 2021 Critical Patch Update introduces a number of Native Network Encryption changes to deal with vulnerability CVE-2021-2351 and prevent the use of weaker ciphers. Customers should review: "Changes in Native Network Encryption with the July 2021 Critical Patch Update" (Doc ID 2791571.1). CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).

The record
Technical detail
CVSS v3.1
8.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02432 · 84.1th percentile
Weaknesses
CWE-327 · Use of a Broken or Risky Cryptographic Algorithm; CWE-384 · Session Fixation
Published
2021-07-21T19:15Z
Affected products (248)
ProductVersionsFixed in
oracle/advanced_networking_optionall versions—
oracle/advanced_networking_optionall versions—
oracle/advanced_networking_optionall versions—
oracle/agile_engineering_data_managementall versions—
oracle/agile_product_lifecycle_managementall versions—
oracle/agile_product_lifecycle_management_for_processall versions—
oracle/agile_product_lifecycle_management_for_processall versions—
oracle/airlines_data_modelall versions—
oracle/airlines_data_modelall versions—
oracle/application_performance_managementall versions—
oracle/application_performance_managementall versions—
oracle/application_testing_suiteall versions—
oracle/argus_analyticsall versions—
oracle/argus_analyticsall versions—
oracle/argus_analyticsall versions—
oracle/argus_insightall versions—
oracle/argus_insightall versions—
oracle/argus_insightall versions—
oracle/argus_martall versions—
oracle/argus_martall versions—
oracle/argus_martall versions—
oracle/argus_safetyall versions—
oracle/argus_safetyall versions—
oracle/argus_safetyall versions—
oracle/banking_apis≥ 18.1, ≤ 18.3—
oracle/banking_apisall versions—
oracle/banking_apisall versions—
oracle/banking_apisall versions—
oracle/banking_apisall versions—
oracle/banking_digital_experience≥ 18.1, ≤ 18.3—
oracle/banking_digital_experienceall versions—
oracle/banking_digital_experienceall versions—
oracle/banking_digital_experienceall versions—
oracle/banking_digital_experienceall versions—
oracle/banking_digital_experienceall versions—
oracle/banking_enterprise_default_managementall versions—
oracle/banking_enterprise_default_managementall versions—
oracle/banking_platformall versions—
oracle/banking_platformall versions—
oracle/banking_platformall versions—
oracle/big_data_spatial_and_graph< 23.123.1
oracle/blockchain_platformall versions—
oracle/clinicalall versions—
oracle/clinicalall versions—
oracle/commerce_platformall versions—
oracle/commerce_platformall versions—
oracle/commerce_platformall versions—
oracle/communications_application_session_controllerall versions—
oracle/communications_billing_and_revenue_managementall versions—
oracle/communications_billing_and_revenue_managementall versions—
oracle/communications_calendar_serverall versions—
oracle/communications_contacts_serverall versions—
oracle/communications_convergent_charging_controller≥ 12.0.1.0.0, ≤ 12.0.4.0.0—
oracle/communications_convergent_charging_controllerall versions—
oracle/communications_data_modelall versions—
oracle/communications_data_modelall versions—
oracle/communications_data_modelall versions—
oracle/communications_data_modelall versions—
oracle/communications_data_modelall versions—
oracle/communications_design_studioall versions—
oracle/communications_design_studioall versions—
oracle/communications_design_studioall versions—
oracle/communications_design_studioall versions—
oracle/communications_diameter_intelligence_hub≥ 8.0.0, ≤ 8.2.3—
oracle/communications_ip_service_activatorall versions—
oracle/communications_metasolv_solutionall versions—
oracle/communications_network_charging_and_control≥ 12.0.1.0, ≤ 12.0.4.0.0—
oracle/communications_network_charging_and_controlall versions—
oracle/communications_network_integrityall versions—
oracle/communications_network_integrityall versions—
oracle/communications_pricing_design_centerall versions—
oracle/communications_pricing_design_centerall versions—
oracle/communications_services_gatekeeperall versions—
oracle/communications_session_report_manager≥ 8.0.0, ≤ 8.2.5.0—
oracle/communications_session_route_manager≥ 8.2.0, ≤ 8.2.5—
oracle/data_integratorall versions—
oracle/data_integratorall versions—
oracle/demantra_demand_management≥ 12.2.6, ≤ 12.2.11—
oracle/documaker≥ 12.6.2, ≤ 12.6.4—
oracle/documakerall versions—
oracle/documakerall versions—
oracle/enterprise_data_qualityall versions—
oracle/enterprise_data_qualityall versions—
oracle/enterprise_manager_base_platformall versions—
oracle/enterprise_manager_base_platformall versions—
oracle/enterprise_manager_ops_centerall versions—
oracle/financial_services_analytical_applications_infrastructure≥ 8.0.7, ≤ 8.1.1—
oracle/financial_services_behavior_detection_platformall versions—
oracle/financial_services_behavior_detection_platformall versions—
oracle/financial_services_behavior_detection_platformall versions—
oracle/financial_services_enterprise_case_managementall versions—
oracle/financial_services_enterprise_case_managementall versions—
oracle/financial_services_enterprise_case_managementall versions—
oracle/financial_services_foreign_account_tax_compliance_act_managementall versions—
oracle/financial_services_foreign_account_tax_compliance_act_managementall versions—
oracle/financial_services_foreign_account_tax_compliance_act_managementall versions—
oracle/financial_services_model_management_and_governance≥ 8.0.8.0.0, ≤ 8.1.1.0.0—
oracle/financial_services_trade-based_anti_money_launderingall versions—
oracle/financial_services_trade-based_anti_money_launderingall versions—
oracle/flexcube_investor_servicingall versions—
oracle/flexcube_investor_servicingall versions—
oracle/flexcube_investor_servicingall versions—
oracle/flexcube_investor_servicingall versions—
oracle/flexcube_investor_servicingall versions—
oracle/flexcube_investor_servicingall versions—
oracle/flexcube_private_bankingall versions—
oracle/flexcube_private_bankingall versions—
oracle/fusion_middlewareall versions—
oracle/fusion_middlewareall versions—
oracle/goldengate< 12.3.0.1.012.3.0.1.0
oracle/insurance_rules_paletteall versions—
oracle/goldengate≥ 19.1.0.0.1, < 21.5.0.0.22011821.5.0.0.220118
oracle/goldengate_application_adapters< 23.123.1
oracle/graph_server_and_client< 21.4.021.4.0
oracle/health_sciences_clinical_development_analyticsall versions—
oracle/health_sciences_inform_crf_submitall versions—
oracle/health_sciences_information_managerall versions—
oracle/health_sciences_information_managerall versions—
oracle/healthcare_data_repositoryall versions—
oracle/healthcare_data_repositoryall versions—
oracle/healthcare_data_repositoryall versions—
oracle/healthcare_foundation≥ 7.3.0, ≤ 7.3.0.2—
oracle/healthcare_foundation≥ 8.0.0, ≤ 8.0.2—
oracle/healthcare_foundation≥ 8.1.0, ≤ 8.1.1—
oracle/healthcare_translational_researchall versions—
oracle/hospitality_inventory_management< 9.1.09.1.0
oracle/hospitality_inventory_managementall versions—
oracle/hospitality_opera_5all versions—
oracle/hospitality_reporting_and_analyticsall versions—
oracle/hospitality_suite8all versions—
oracle/hospitality_suite8all versions—
oracle/hospitality_suite8all versions—
oracle/hospitality_suite8all versions—
oracle/hospitality_suite8all versions—
oracle/hyperion_infrastructure_technologyall versions—
oracle/ilearningall versions—
oracle/ilearningall versions—
oracle/instantis_enterprisetrackall versions—
oracle/instantis_enterprisetrackall versions—
oracle/instantis_enterprisetrackall versions—
oracle/insurance_data_gatewayall versions—
oracle/insurance_data_gatewayall versions—
oracle/insurance_data_gatewayall versions—
oracle/insurance_data_gatewayall versions—
oracle/insurance_data_gatewayall versions—
oracle/insurance_insbridge_rating_and_underwriting≥ 5.4, ≤ 5.6.0—
oracle/insurance_insbridge_rating_and_underwritingall versions—
oracle/insurance_policy_administrationall versions—
oracle/insurance_policy_administrationall versions—
oracle/insurance_policy_administrationall versions—
oracle/insurance_policy_administrationall versions—
oracle/insurance_policy_administrationall versions—
oracle/insurance_rules_paletteall versions—
oracle/insurance_rules_paletteall versions—
oracle/insurance_rules_paletteall versions—
oracle/insurance_rules_paletteall versions—
oracle/jd_edwards_enterpriseone_toolsall versions—
oracle/oss_support_tools< 2.12.422.12.42
oracle/peoplesoft_enterprise_peopletoolsall versions—
oracle/peoplesoft_enterprise_peopletoolsall versions—
oracle/peoplesoft_enterprise_peopletoolsall versions—
oracle/policy_automation≥ 12.2.0, ≤ 12.2.24—
oracle/primavera_analyticsall versions—
oracle/primavera_analyticsall versions—
oracle/primavera_analyticsall versions—
oracle/primavera_data_warehouseall versions—
oracle/primavera_data_warehouseall versions—
oracle/primavera_data_warehouseall versions—
oracle/primavera_gateway≥ 17.12.0, ≤ 17.12.11—
oracle/primavera_gateway≥ 18.8.0, ≤ 18.8.12—
oracle/primavera_gateway≥ 19.12.0, ≤ 19.12.11—
oracle/primavera_gateway≥ 20.12.0, ≤ 20.12.7—
oracle/primavera_p6_enterprise_project_portfolio_management≥ 17.12.0.0, ≤ 17.12.20—
oracle/primavera_p6_enterprise_project_portfolio_management≥ 18.8.0.0, ≤ 18.8.24—
oracle/primavera_p6_enterprise_project_portfolio_management≥ 19.12.0.0, ≤ 19.12.17.0—
oracle/primavera_p6_enterprise_project_portfolio_management≥ 20.12.0.0, ≤ 20.12.9.0—
oracle/primavera_p6_professional_project_management≥ 17.12, ≤ 17.12.20.0—
oracle/primavera_p6_professional_project_management≥ 18.8, ≤ 18.8.24.0—
oracle/primavera_p6_professional_project_management≥ 19.12.0.0, ≤ 19.12.17.0—
oracle/primavera_p6_professional_project_management≥ 20.12.0.0, ≤ 20.12.9.0—
oracle/primavera_unifier≥ 17.7, ≤ 17.12—
oracle/primavera_unifierall versions—
oracle/primavera_unifierall versions—
oracle/primavera_unifierall versions—
oracle/primavera_unifierall versions—
oracle/product_lifecycle_analyticsall versions—
oracle/rapid_planning≥ 12.2.6, ≤ 12.2.11—
oracle/real_user_experience_insightall versions—
oracle/real_user_experience_insightall versions—
oracle/retail_analytics≥ 16.0.0, ≤ 16.0.2—
oracle/retail_assortment_planningall versions—
oracle/retail_back_officeall versions—
oracle/retail_central_officeall versions—
oracle/retail_customer_insights≥ 16.0, ≤ 16.0.2—
oracle/retail_extract_transform_and_loadall versions—
oracle/retail_financial_integrationall versions—
oracle/retail_financial_integrationall versions—
oracle/retail_financial_integrationall versions—
oracle/retail_financial_integrationall versions—
oracle/retail_integration_busall versions—
oracle/retail_integration_busall versions—
oracle/retail_integration_busall versions—
oracle/retail_integration_busall versions—
oracle/retail_merchandising_systemall versions—
oracle/retail_order_brokerall versions—
oracle/retail_order_brokerall versions—
oracle/retail_order_brokerall versions—
oracle/retail_order_management_systemall versions—
oracle/retail_point-of-serviceall versions—
oracle/retail_predictive_application_serverall versions—
oracle/retail_predictive_application_serverall versions—
oracle/retail_predictive_application_serverall versions—
oracle/retail_price_managementall versions—
oracle/retail_price_managementall versions—
oracle/retail_price_managementall versions—
oracle/retail_returns_managementall versions—
oracle/retail_service_backboneall versions—
oracle/retail_service_backboneall versions—
oracle/retail_service_backboneall versions—
oracle/retail_service_backboneall versions—
oracle/retail_store_inventory_managementall versions—
oracle/retail_store_inventory_managementall versions—
oracle/retail_store_inventory_managementall versions—
oracle/retail_xstore_point_of_serviceall versions—
oracle/retail_xstore_point_of_serviceall versions—
oracle/retail_xstore_point_of_serviceall versions—
oracle/retail_xstore_point_of_serviceall versions—
oracle/siebel_ui_framework≤ 21.12—
oracle/spatial_studio< 21.2.121.2.1
oracle/storagetek_acslsall versions—
oracle/storagetek_tape_analyticsall versions—
oracle/thesaurus_management_systemall versions—
oracle/thesaurus_management_systemall versions—
oracle/thesaurus_management_systemall versions—
oracle/timesten_in-memory_database< 21.1.1.1.021.1.1.1.0
oracle/timesten_in-memory_databaseall versions—
oracle/utilities_framework≥ 4.3.0.1.0, ≤ 4.3.0.6.0—
oracle/utilities_frameworkall versions—
oracle/utilities_frameworkall versions—
oracle/utilities_frameworkall versions—
oracle/utilities_frameworkall versions—
oracle/utilities_testing_acceleratorall versions—
oracle/utilities_testing_acceleratorall versions—
oracle/utilities_testing_acceleratorall versions—
oracle/weblogic_serverall versions—
oracle/weblogic_serverall versions—
oracle/weblogic_serverall versions—
oracle/zfs_storage_application_integration_engineering_softwareall versions—
References (20)
https://www.oracle.com/security-alerts/cpujul2022.html · af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/165255/Oracle-Database-Protection-Mechanism-Bypass.html · [email protected]http://packetstormsecurity.com/files/165258/Oracle-Database-Weak-NNE-Integrity-Key-Derivation.html · [email protected]http://seclists.org/fulldisclosure/2021/Dec/19 · [email protected]http://seclists.org/fulldisclosure/2021/Dec/20 · [email protected]https://www.oracle.com/security-alerts/cpuapr2022.html · [email protected]https://www.oracle.com/security-alerts/cpujan2022.html · [email protected]https://www.oracle.com/security-alerts/cpujan2023.html · [email protected]https://www.oracle.com/security-alerts/cpujul2021.html · [email protected]https://www.oracle.com/security-alerts/cpujul2022.html · [email protected]https://www.oracle.com/security-alerts/cpuoct2021.html · [email protected]http://packetstormsecurity.com/files/165255/Oracle-Database-Protection-Mechanism-Bypass.html · af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/165258/Oracle-Database-Weak-NNE-Integrity-Key-Derivation.html · af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2021/Dec/19 · af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2021/Dec/20 · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuapr2022.html · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujan2022.html · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujan2023.html · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujul2021.html · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuoct2021.html · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 20 JUL 22:43Z
    Vulnerability in the Advanced Networking Option component of Oracle Database Server
    cvelistv5