Skip to content
OpenAdvisories
Medium · 5.3 CVE-2021-2163 EUVD-2021-16622GHSA-6mm5-r7wc-h7pm

Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Support…

Published Apr 22, 2021 · Updated Sep 26, 2024 · Assigned by oracle

Description

Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u291, 8u281, 11.0.10, 16; Java SE Embedded: 8u281; Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1.2 and 21.0.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N).

Affected products

VendorProductAffectedFixed
Oracle Java SE JDK and JRE Java SE:7u291, Java SE:8u281, Java SE:11.0.10, Java SE:16, Java SE Embedded:8u281, Oracle GraalVM Enterprise Edition:19.3.5, Oracle GraalVM Enterprise Edition:20.3.1.2, Oracle GraalVM Enterprise Edition:21.0.0.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 12 openjdk-17 17~19-1 —
Debian 10 openjdk-11 11.0.11+9-1~deb10u1 DSA-4899-1
Debian 9 openjdk-8 8u292-b10-0+deb9u1 DLA-2634-1
ReleasePackageFixed inAdvisory
Ubuntu 26.10 icedtea-web No fix yet —
Ubuntu 26.04 LTS icedtea-web No fix yet —
Ubuntu 25.10 icedtea-web No fix yet —
Ubuntu 24.04 LTS icedtea-web No fix yet —
Ubuntu 22.04 LTS icedtea-web No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS openjdk-13 +1 No fix yet —
Ubuntu 20.04 LTS openjdk-8 8u292-b10-0ubuntu1~20.04 USN-4892-1
Ubuntu 20.04 LTS openjdk-lts 11.0.11+9-0ubuntu2~20.04 USN-4892-1
Ubuntu 18.04 LTS icedtea-web No fix yet —
Ubuntu 18.04 LTS openjdk-8 8u292-b10-0ubuntu1~18.04 USN-4892-1
Ubuntu 18.04 LTS openjdk-lts 11.0.11+9-0ubuntu2~18.04 USN-4892-1
Ubuntu 16.04 LTS openjdk-8 8u292-b10-0ubuntu1~16.04.1 USN-4892-1
Ubuntu 16.04 LTS openjdk-9 +1 No fix yet —
ReleasePackageFixed inAdvisory
RHEL 8 java-1.8.0-ibm +7 1:1.8.0.7.15-1.el8_6 RHSA-2022:6735
RHEL 8 java-1.8.0-openjdk +7 1:1.8.0.292.b10-0.el8_3 RHSA-2021:1301
RHEL 8 java-11-openjdk +8 1:11.0.11.0.9-0.el8_3 RHSA-2021:1307
RHEL 7 java-1.7.1-ibm +5 1:1.7.1.5.15-1jpp.1.el7 RHSA-2022:6755
RHEL 7 java-1.8.0-ibm +5 1:1.8.0.7.15-1jpp.1.el7 RHSA-2022:6756
RHEL 7 java-1.8.0-openjdk +7 1:1.8.0.292.b10-1.el7_9 RHSA-2021:1298
RHEL 7 java-11-openjdk +8 1:11.0.11.0.9-1.el7_9 RHSA-2021:1297
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 8.2 EUS java-1.8.0-openjdk +7 1:1.8.0.292.b10-0.el8_2 RHSA-2021:1299
RHEL 8.2 EUS java-11-openjdk +8 1:11.0.11.0.9-0.el8_2 RHSA-2021:1306
RHEL 8.1 EUS java-1.8.0-openjdk +7 1:1.8.0.292.b10-0.el8_1 RHSA-2021:1315
RHEL 8.1 EUS java-11-openjdk +7 1:11.0.11.0.9-0.el8_1 RHSA-2021:1305
ReleasePackageFixed inAdvisory
SLES 15 SP3 java-11-openjdk 11.0.11.0-3.56.1 SUSE-SU-2021:1554-1
SLES 15 SP3 java-1_8_0-ibm 1.8.0_sr7.0-3.53.1 SUSE-SU-2022:0108-1
SLES 15 SP3 java-1_8_0-openjdk 1.8.0.292-3.52.1 SUSE-SU-2021:1989-1
SLES 15 SP2 java-11-openjdk 11.0.11.0-3.56.1 SUSE-SU-2021:1554-1
SLES 15 SP2 java-1_8_0-ibm 1.8.0_sr7.0-3.53.1 SUSE-SU-2022:0108-1
SLES 15 SP2 java-1_8_0-openjdk 1.8.0.292-3.52.1 SUSE-SU-2021:1989-1
SLES 15 SP1 java-11-openjdk 11.0.11.0-3.56.1 SUSE-SU-2021:1554-1
SLES 15 SP1 java-1_8_0-ibm 1.8.0_sr7.0-3.53.1 SUSE-SU-2022:0108-1
SLES 15 SP1 java-1_8_0-openjdk 1.8.0.292-3.52.1 SUSE-SU-2021:1989-1
SLES 15 java-11-openjdk 11.0.11.0-3.56.1 SUSE-SU-2021:1554-1
SLES 15 java-1_8_0-ibm 1.8.0_sr7.0-3.53.1 SUSE-SU-2022:0108-1
SLES 15 java-1_8_0-openjdk 1.8.0.292-3.52.1 SUSE-SU-2021:1989-1
SLES 12 SP5 java-11-openjdk 11.0.11.0-3.21.1 SUSE-SU-2021:1314-1
SLES 12 SP5 java-1_7_0-openjdk 1.7.0.311-43.50.2 SUSE-SU-2021:3007-1
SLES 12 SP5 java-1_7_1-ibm 1.7.1_sr5.0-38.65.1 SUSE-SU-2022:0166-1
SLES 12 SP5 java-1_8_0-ibm 1.8.0_sr7.0-30.84.1 SUSE-SU-2022:0107-1
SLES 12 SP5 java-1_8_0-openjdk 1.8.0.292-27.60.1 SUSE-SU-2021:1980-1
Show 26 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 12 SP4 java-1_7_1-ibm 1.7.1_sr5.0-38.65.1 SUSE-SU-2022:0166-1
SLES 12 SP4 java-1_8_0-ibm 1.8.0_sr7.0-30.84.1 SUSE-SU-2022:0107-1
SLES 12 SP4 java-1_8_0-openjdk 1.8.0.292-27.60.1 SUSE-SU-2021:1980-1
SLES 12 SP3 java-1_7_1-ibm 1.7.1_sr5.0-38.65.1 SUSE-SU-2022:0166-1
SLES 12 SP3 java-1_8_0-ibm 1.8.0_sr7.0-30.84.1 SUSE-SU-2022:0107-1
SLES 12 SP3 java-1_8_0-openjdk 1.8.0.292-27.60.1 SUSE-SU-2021:1980-1
SLES 12 SP2 java-1_7_1-ibm 1.7.1_sr5.0-38.65.1 SUSE-SU-2022:0166-1
SLES 12 SP2 java-1_8_0-ibm 1.8.0_sr7.0-30.84.1 SUSE-SU-2022:0107-1
SLES 12 SP2 java-1_8_0-openjdk 1.8.0.292-27.60.1 SUSE-SU-2021:1980-1
SLES 11 SP4 java-1_7_1-ibm 1.7.1_sr5.0-26.68.1 SUSE-SU-2022:14875-1
SLES for SAP 15 SP2 java-1_8_0-ibm 1.8.0_sr7.0-3.53.1 SUSE-SU-2022:0108-1
SLES for SAP 15 SP1 java-11-openjdk 11.0.11.0-3.56.1 SUSE-SU-2021:1554-1
SLES for SAP 15 SP1 java-1_8_0-ibm 1.8.0_sr7.0-3.53.1 SUSE-SU-2022:0108-1
SLES for SAP 15 SP1 java-1_8_0-openjdk 1.8.0.292-3.52.1 SUSE-SU-2021:1989-1
SLES for SAP 15 java-11-openjdk 11.0.11.0-3.56.1 SUSE-SU-2021:1554-1
SLES for SAP 15 java-1_8_0-ibm 1.8.0_sr7.0-3.53.1 SUSE-SU-2022:0108-1
SLES for SAP 15 java-1_8_0-openjdk 1.8.0.292-3.52.1 SUSE-SU-2021:1989-1
SLES for SAP 12 SP5 java-11-openjdk 11.0.11.0-3.21.1 SUSE-SU-2021:1314-1
SLES for SAP 12 SP5 java-1_7_0-openjdk 1.7.0.311-43.50.2 SUSE-SU-2021:3007-1
SLES for SAP 12 SP5 java-1_7_1-ibm 1.7.1_sr5.0-38.65.1 SUSE-SU-2022:0166-1
SLES for SAP 12 SP5 java-1_8_0-ibm 1.8.0_sr7.0-30.84.1 SUSE-SU-2022:0107-1
SLES for SAP 12 SP5 java-1_8_0-openjdk 1.8.0.292-27.60.1 SUSE-SU-2021:1980-1
SLES for SAP 12 SP4 java-1_7_1-ibm 1.7.1_sr5.0-38.65.1 SUSE-SU-2022:0166-1
SLES for SAP 12 SP4 java-1_8_0-ibm 1.8.0_sr7.0-30.84.1 SUSE-SU-2022:0107-1
SLES for SAP 12 SP4 java-1_8_0-openjdk 1.8.0.292-27.60.1 SUSE-SU-2021:1980-1
SLES for SAP 12 SP3 java-1_7_1-ibm 1.7.1_sr5.0-38.65.1 SUSE-SU-2022:0166-1
SLES for SAP 12 SP3 java-1_8_0-ibm 1.8.0_sr7.0-30.84.1 SUSE-SU-2022:0107-1
SLES for SAP 12 SP3 java-1_8_0-openjdk 1.8.0.292-27.60.1 SUSE-SU-2021:1980-1
SLE HPC 15 SP1 java-11-openjdk 11.0.11.0-3.56.1 SUSE-SU-2021:1554-1
SLE HPC 15 java-11-openjdk 11.0.11.0-3.56.1 SUSE-SU-2021:1554-1
SUSE OpenStack Cloud Crowbar 9 java-1_7_1-ibm 1.7.1_sr5.0-38.65.1 SUSE-SU-2022:0166-1
SUSE OpenStack Cloud Crowbar 9 java-1_8_0-ibm 1.8.0_sr7.0-30.84.1 SUSE-SU-2022:0107-1
SUSE OpenStack Cloud Crowbar 9 java-1_8_0-openjdk 1.8.0.292-27.60.1 SUSE-SU-2021:1980-1
SUSE OpenStack Cloud Crowbar 8 java-1_7_1-ibm 1.7.1_sr5.0-38.65.1 SUSE-SU-2022:0166-1
SUSE OpenStack Cloud Crowbar 8 java-1_8_0-ibm 1.8.0_sr7.0-30.84.1 SUSE-SU-2022:0107-1
SUSE OpenStack Cloud Crowbar 8 java-1_8_0-openjdk 1.8.0.292-27.60.1 SUSE-SU-2021:1980-1
SUSE OpenStack Cloud 9 java-1_7_1-ibm 1.7.1_sr5.0-38.65.1 SUSE-SU-2022:0166-1
SUSE OpenStack Cloud 9 java-1_8_0-ibm 1.8.0_sr7.0-30.84.1 SUSE-SU-2022:0107-1
SUSE OpenStack Cloud 9 java-1_8_0-openjdk 1.8.0.292-27.60.1 SUSE-SU-2021:1980-1
SUSE OpenStack Cloud 8 java-1_7_1-ibm 1.7.1_sr5.0-38.65.1 SUSE-SU-2022:0166-1
SUSE OpenStack Cloud 8 java-1_8_0-ibm 1.8.0_sr7.0-30.84.1 SUSE-SU-2022:0107-1
SUSE OpenStack Cloud 8 java-1_8_0-openjdk 1.8.0.292-27.60.1 SUSE-SU-2021:1980-1
SUSE Manager Server 4.1 java-1_8_0-ibm 1.8.0_sr7.0-3.53.1 SUSE-SU-2022:0108-1
SUSE Manager Server 4.0 java-11-openjdk 11.0.11.0-3.56.1 SUSE-SU-2021:1554-1
SUSE Manager Server 4.0 java-1_8_0-openjdk 1.8.0.292-3.52.1 SUSE-SU-2021:1989-1
SUSE Manager Retail Branch Server 4.1 java-1_8_0-ibm 1.8.0_sr7.0-3.53.1 SUSE-SU-2022:0108-1
SUSE Manager Retail Branch Server 4.0 java-11-openjdk 11.0.11.0-3.56.1 SUSE-SU-2021:1554-1
SUSE Manager Retail Branch Server 4.0 java-1_8_0-openjdk 1.8.0.292-3.52.1 SUSE-SU-2021:1989-1
SUSE Manager Proxy 4.1 java-1_8_0-ibm 1.8.0_sr7.0-3.53.1 SUSE-SU-2022:0108-1
SUSE Manager Proxy 4.0 java-11-openjdk 11.0.11.0-3.56.1 SUSE-SU-2021:1554-1
SUSE Manager Proxy 4.0 java-1_8_0-openjdk 1.8.0.292-3.52.1 SUSE-SU-2021:1989-1
SUSE Linux Enterprise Point of Sale 11 SP3 java-1_7_0-ibm 1.7.0_sr11.0-65.63.1 SUSE-SU-2022:14876-1
SUSE HPE Helion OpenStack 8 java-1_7_1-ibm 1.7.1_sr5.0-38.65.1 SUSE-SU-2022:0166-1
SUSE HPE Helion OpenStack 8 java-1_8_0-ibm 1.8.0_sr7.0-30.84.1 SUSE-SU-2022:0107-1
SUSE HPE Helion OpenStack 8 java-1_8_0-openjdk 1.8.0.292-27.60.1 SUSE-SU-2021:1980-1
SUSE Enterprise Storage 7 java-1_8_0-ibm 1.8.0_sr7.0-3.53.1 SUSE-SU-2022:0108-1
SUSE Enterprise Storage 6 java-11-openjdk 11.0.11.0-3.56.1 SUSE-SU-2021:1554-1
SUSE Enterprise Storage 6 java-1_8_0-ibm 1.8.0_sr7.0-3.53.1 SUSE-SU-2022:0108-1
SUSE Enterprise Storage 6 java-1_8_0-openjdk 1.8.0.292-3.52.1 SUSE-SU-2021:1989-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed java-11-openjdk 11.0.12.0-3.1 openSUSE-SU-2024:10871-1
openSUSE Tumbleweed java-13-openjdk 13.0.8.0-3.1 openSUSE-SU-2024:10872-1
openSUSE Tumbleweed java-15-openjdk 15.0.4.0-2.1 openSUSE-SU-2024:10873-1
openSUSE Tumbleweed java-16-openjdk 16.0.2.0-2.1 openSUSE-SU-2024:10874-1
openSUSE Tumbleweed java-1_8_0-openj9 1.8.0.312-1.1 openSUSE-SU-2024:11601-1
openSUSE Tumbleweed java-1_8_0-openjdk 1.8.0.302-2.2 openSUSE-SU-2024:10876-1
openSUSE Leap 15.3 java-1_8_0-ibm 1.8.0_sr7.0-3.53.1 openSUSE-SU-2022:0108-1
openSUSE Leap 15.3 java-1_8_0-openj9 1.8.0.292-3.14.1 openSUSE-SU-2021:3615-1, openSUSE-SU-2021:1666-1
openSUSE Leap 15.3 java-1_8_0-openjdk 1.8.0.292-3.52.1 openSUSE-SU-2021:1989-1
openSUSE Leap 15.3 seamonkey 2.53.11.1-lp153.17.5.1 openSUSE-SU-2022:0108-1
openSUSE Leap 15.2 java-11-openjdk 11.0.11.0-lp152.2.12.1 openSUSE-SU-2021:0719-1
openSUSE Leap 15.2 java-1_8_0-openj9 1.8.0.292-lp152.3.9.1 openSUSE-SU-2021:1455-1, openSUSE-SU-2021:0776-1
openSUSE Leap 15.2 java-1_8_0-openjdk 1.8.0.292-lp152.2.12.2 openSUSE-SU-2021:0933-1
ReleasePackageFixed inAdvisory
Alpine v3.18 openjdk7 7.301.2.6.26-r0 —
Alpine v3.17 openjdk7 7.301.2.6.26-r0 —
Alpine v3.16 openjdk7 7.301.2.6.26-r0 —
Alpine v3.15 openjdk7 7.301.2.6.26-r0 —
Alpine v3.14 openjdk7 7.301.2.6.26-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2 java-1.8.0-openjdk +15 1:1.8.0.302.b08-0.amzn2.0.1 ALAS2-2021-1695

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 8 java-1.8.0-openjdk +7 1:1.8.0.292.b10-0.el8_3 ELSA-2021-1301
Oracle Linux 8 java-11-openjdk +8 1:11.0.11.0.9-0.el8_3 ELSA-2021-1307
Oracle Linux 7 java-1.8.0-openjdk +7 1:1.8.0.292.b10-1.el7_9 ELSA-2021-1298
Oracle Linux 7 java-11-openjdk +8 1:11.0.11.0.9-1.0.1.el7_9 ELSA-2021-1297

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling openjdk-10 +3 No fix yet —
Wolfi rolling openjdk-12-jre-base 12.0.2.10-r10 —

Advisories 44

References