CVE-2021-2351
High
Description
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Advanced Networking Option, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Advanced Networking Option. Note: The July 2021 Critical Patch Update introduces a number of Native Network Encryption changes to deal with vulnerability CVE-2021-2351 and prevent the use of weaker ciphers. Customers should review: "Changes in Native Network Encryption with the July 2021 Critical Patch Update" (Doc ID 2791571.1). CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).
SeverityHigh
CVSS8.3
Exploit probability—
Product
Oracle Advanced Networking Option
PublishedJul 21, 2021
First seenJul 21, 2021
How to fix
Update
- oracle big_data_spatial_and_graph23.1 or later
- oracle goldengate12.3.0.1.0, 21.5.0.0.220118 or later
- oracle goldengate_application_adapters23.1 or later
- oracle graph_server_and_client21.4.0 or later
- oracle hospitality_inventory_management9.1.0 or later
- oracle oss_support_tools2.12.42 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| oracle advanced_networking_option | 12.1.0.2, 12.2.0.1, 19c | — |
| oracle agile_engineering_data_management | 6.2.1.0 | — |
| oracle agile_product_lifecycle_management | 9.3.6 | — |
| oracle agile_product_lifecycle_management_for_process | 6.2.2.0, 6.2.3.0 | — |
| oracle airlines_data_model | 12.1.1.0.0, 12.2.0.1.0 | — |
| oracle application_performance_management | 13.4.1.0, 13.5.1.0 | — |
| oracle application_testing_suite | 13.3.0.1 | — |
| oracle argus_analytics | 8.2.1, 8.2.2, 8.2.3 | — |
| oracle argus_insight | 8.2.1, 8.2.2, 8.2.3 | — |
| oracle argus_mart | 8.2.1, 8.2.2, 8.2.3 | — |
| oracle argus_safety | 8.2.1, 8.2.2, 8.2.3 | — |
| oracle banking_apis | 18.1 ≤ v ≤ 18.3, 19.1, 19.2, 20.1, 21.1 | — |
| oracle banking_digital_experience | 18.1 ≤ v ≤ 18.3, 17.2, 19.1, 19.2, 20.1, 21.1 | — |
| oracle banking_enterprise_default_management | 2.10.0, 2.12.0 | — |
| oracle banking_platform | 2.6.2, 2.7.1, 2.12.0 | — |
| oracle big_data_spatial_and_graph | v < 23.1 | 23.1 |
| oracle blockchain_platform | 21.1.2 | — |
| oracle clinical | 5.2.1, 5.2.2 | — |
| oracle commerce_platform | 11.3.0, 11.3.1, 11.3.2 | — |
| oracle communications_application_session_controller | 3.9.0 | — |
| oracle communications_billing_and_revenue_management | 12.0.0.4, 12.0.0.5 | — |
| oracle communications_calendar_server | 8.0.0.5.0 | — |
| oracle communications_contacts_server | 8.0.0.3.0 | — |
| oracle communications_convergent_charging_controller | 12.0.1.0.0 ≤ v ≤ 12.0.4.0.0, 6.0.1.0.0 | — |
| oracle communications_data_model | 11.3.2.1.0, 11.3.2.2.0, 11.3.2.3.0, 12.1.0.1.0, 12.1.2.0.0 | — |
| oracle communications_design_studio | 7.3.5, 7.4.0, 7.4.1, 7.4.2 | — |
| oracle communications_diameter_intelligence_hub | 8.0.0 ≤ v ≤ 8.2.3 | — |
| oracle communications_ip_service_activator | 7.4.0 | — |
| oracle communications_metasolv_solution | 6.3.1 | — |
| oracle communications_network_charging_and_control | 12.0.1.0 ≤ v ≤ 12.0.4.0.0, 6.0.1.0.0 | — |
| oracle communications_network_integrity | 7.3.5, 7.3.6 | — |
| oracle communications_pricing_design_center | 12.0.0.4, 12.0.0.5 | — |
| oracle communications_services_gatekeeper | 7.0 | — |
| oracle communications_session_report_manager | 8.0.0 ≤ v ≤ 8.2.5.0 | — |
| oracle communications_session_route_manager | 8.2.0 ≤ v ≤ 8.2.5 | — |
| oracle data_integrator | 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle demantra_demand_management | 12.2.6 ≤ v ≤ 12.2.11 | — |
| oracle documaker | 12.6.2 ≤ v ≤ 12.6.4, 12.6.0, 12.7.0 | — |
| oracle enterprise_data_quality | 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle enterprise_manager_base_platform | 13.4.0.0, 13.5.0.0 | — |
| oracle enterprise_manager_ops_center | 12.4.0.0 | — |
| oracle financial_services_analytical_applications_infrastructure | 8.0.7 ≤ v ≤ 8.1.1 | — |
| oracle financial_services_behavior_detection_platform | 8.0.7, 8.0.8, 8.0.11 | — |
| oracle financial_services_enterprise_case_management | 8.0.7, 8.0.8, 8.0.11 | — |
| oracle financial_services_foreign_account_tax_compliance_act_management | 8.0.7, 8.0.8, 8.0.11 | — |
| oracle financial_services_model_management_and_governance | 8.0.8.0.0 ≤ v ≤ 8.1.1.0.0 | — |
| oracle financial_services_trade-based_anti_money_laundering | 8.0.7, 8.0.8 | — |
| oracle flexcube_investor_servicing | 12.0.4, 12.1.0, 12.3.0, 12.4.0, 14.4.0, 14.5.0 | — |
| oracle flexcube_private_banking | 12.0.0, 12.1.0 | — |
| oracle fusion_middleware | 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle goldengate | v < 12.3.0.1.0, 19.1.0.0.1 ≤ v < 21.5.0.0.220118 | 12.3.0.1.0, 21.5.0.0.220118 |
| oracle goldengate_application_adapters | v < 23.1 | 23.1 |
| oracle graph_server_and_client | v < 21.4.0 | 21.4.0 |
| oracle health_sciences_clinical_development_analytics | 4.0.1 | — |
| oracle health_sciences_inform_crf_submit | 6.2.1 | — |
| oracle health_sciences_information_manager | 3.0.2, 3.0.3 | — |
| oracle healthcare_data_repository | 7.0.2, 8.1.0, 8.1.1 | — |
| oracle healthcare_foundation | 7.3.0 ≤ v ≤ 7.3.0.2, 8.0.0 ≤ v ≤ 8.0.2, 8.1.0 ≤ v ≤ 8.1.1 | — |
| oracle healthcare_translational_research | 4.1.0 | — |
| oracle hospitality_inventory_management | v < 9.1.0, 9.1.0 | 9.1.0 |
| oracle hospitality_opera_5 | 5.6 | — |
| oracle hospitality_reporting_and_analytics | 9.1.0 | — |
| oracle hospitality_suite8 | 8.10.2, 8.11.0, 8.12.0, 8.13.0, 8.14.0 | — |
| oracle hyperion_infrastructure_technology | 11.2.7.0 | — |
| oracle ilearning | 6.2, 6.3 | — |
| oracle instantis_enterprisetrack | 17.1, 17.2, 17.3 | — |
| oracle insurance_data_gateway | 11.0.2, 11.1.0, 11.2.7, 11.3.0, 11.3.1 | — |
| oracle insurance_insbridge_rating_and_underwriting | 5.4 ≤ v ≤ 5.6.0, 5.2.0 | — |
| oracle insurance_policy_administration | 11.0.2, 11.1.0, 11.2.7, 11.3.0, 11.3.1 | — |
| oracle insurance_rules_palette | 11.0.2, 11.1.0, 11.2.7, 11.3.0, 11.3.1 | — |
| oracle jd_edwards_enterpriseone_tools | 9.2.6.3 | — |
| oracle oss_support_tools | v < 2.12.42 | 2.12.42 |
| oracle peoplesoft_enterprise_peopletools | 8.57, 8.58, 8.59 | — |
| oracle policy_automation | 12.2.0 ≤ v ≤ 12.2.24 | — |
| oracle primavera_analytics | 18.8.3.3, 19.12.11.1, 20.12.12.0 | — |
| oracle primavera_data_warehouse | 18.8.3.3, 19.12.11.1, 20.12.12.0 | — |
| oracle primavera_gateway | 17.12.0 ≤ v ≤ 17.12.11, 18.8.0 ≤ v ≤ 18.8.12, 19.12.0 ≤ v ≤ 19.12.11, 20.12.0 ≤ v ≤ 20.12.7 | — |
| oracle primavera_p6_enterprise_project_portfolio_management | 17.12.0.0 ≤ v ≤ 17.12.20, 18.8.0.0 ≤ v ≤ 18.8.24, 19.12.0.0 ≤ v ≤ 19.12.17.0, 20.12.0.0 ≤ v ≤ 20.12.9.0 | — |
| oracle primavera_p6_professional_project_management | 17.12 ≤ v ≤ 17.12.20.0, 18.8 ≤ v ≤ 18.8.24.0, 19.12.0.0 ≤ v ≤ 19.12.17.0, 20.12.0.0 ≤ v ≤ 20.12.9.0 | — |
| oracle primavera_unifier | 17.7 ≤ v ≤ 17.12, 18.8, 19.12, 20.12, 21.12 | — |
| oracle product_lifecycle_analytics | 3.6.1 | — |
| oracle rapid_planning | 12.2.6 ≤ v ≤ 12.2.11 | — |
| oracle real_user_experience_insight | 13.4.1.0, 13.5.1.0 | — |
| oracle retail_analytics | 16.0.0 ≤ v ≤ 16.0.2 | — |
| oracle retail_assortment_planning | 16.0.3 | — |
| oracle retail_back_office | 14.1 | — |
| oracle retail_central_office | 14.1 | — |
| oracle retail_customer_insights | 16.0 ≤ v ≤ 16.0.2 | — |
| oracle retail_extract_transform_and_load | 13.2.8 | — |
| oracle retail_financial_integration | 14.1.3.2, 15.0.3.1, 16.0.3.0, 19.0.1 | — |
| oracle retail_integration_bus | 14.1.3.2 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.