Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2023-03673

Опубликовано: 19 окт. 2021
Источник: fstec
CVSS3: 5.9
CVSS2: 5.4
EPSS Низкий

Описание

Уязвимость компонента JSSE программной платформы Oracle Java SE и виртуальной машины Oracle GraalVM Enterprise Edition связана с использованием криптографических алгоритмов, содержащих дефекты. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить несанкционированный доступ к защищаемой информации

Вендор

Red Hat Inc.
Novell Inc.
Сообщество свободного программного обеспечения
Canonical Ltd.
Fedora Project
ООО «Ред Софт»
АО «ИВК»
Oracle Corp.
АО "НППКТ"
АО «Концерн ВНИИНС»

Наименование ПО

Red Hat Enterprise Linux
Suse Linux Enterprise Desktop
SUSE Linux Enterprise Server for SAP Applications
Suse Linux Enterprise Server
Debian GNU/Linux
Ubuntu
OpenSUSE Leap
Fedora
РЕД ОС
Альт 8 СП
Red Hat build of OpenJDK
Java SE
GraalVM Enterprise Edition
ОСОН ОСнова Оnyx
OpenJDK
ОС ОН «Стрелец»

Версия ПО

7 (Red Hat Enterprise Linux)
12 SP3 (Suse Linux Enterprise Desktop)
12 SP4 (Suse Linux Enterprise Desktop)
12 SP2 (SUSE Linux Enterprise Server for SAP Applications)
12 SP3 (SUSE Linux Enterprise Server for SAP Applications)
12 SP4 (SUSE Linux Enterprise Server for SAP Applications)
12 SP4 (Suse Linux Enterprise Server)
8 (Red Hat Enterprise Linux)
12 SP2-BCL (Suse Linux Enterprise Server)
12 SP2-ESPOS (Suse Linux Enterprise Server)
12-LTSS (Suse Linux Enterprise Server)
12 SP1 (SUSE Linux Enterprise Server for SAP Applications)
15 (SUSE Linux Enterprise Server for SAP Applications)
15 SP1 (SUSE Linux Enterprise Server for SAP Applications)
12 SP1-LTSS (Suse Linux Enterprise Server)
12 SP2-LTSS (Suse Linux Enterprise Server)
12 SP3-LTSS (Suse Linux Enterprise Server)
12 SP3-BCL (Suse Linux Enterprise Server)
12 SP5 (Suse Linux Enterprise Server)
12 SP5 (SUSE Linux Enterprise Server for SAP Applications)
10 (Debian GNU/Linux)
12 SP3-ESPOS (Suse Linux Enterprise Server)
12 SP2 (Suse Linux Enterprise Desktop)
12 SP2 (Suse Linux Enterprise Server)
15-LTSS (Suse Linux Enterprise Server)
12 SP1 (Suse Linux Enterprise Desktop)
12 SP1 (Suse Linux Enterprise Server)
20.04 LTS (Ubuntu)
12 (Suse Linux Enterprise Desktop)
15.2 (OpenSUSE Leap)
8.1 Extended Update Support (Red Hat Enterprise Linux)
12 SP4-ESPOS (Suse Linux Enterprise Server)
33 (Fedora)
8.2 Extended Update Support (Red Hat Enterprise Linux)
12 SP4-LTSS (Suse Linux Enterprise Server)
21.04 (Ubuntu)
15 SP1-BCL (Suse Linux Enterprise Server)
15 SP1-LTSS (Suse Linux Enterprise Server)
34 (Fedora)
16.04 ESM (Ubuntu)
15.3 (OpenSUSE Leap)
15 SP1 (Suse Linux Enterprise Server)
11 (Debian GNU/Linux)
35 (Fedora)
21.10 (Ubuntu)
12 (Suse Linux Enterprise Server)
7.3 (РЕД ОС)
15.4 (OpenSUSE Leap)
15 SP3 (Suse Linux Enterprise Server)
15 SP3 (SUSE Linux Enterprise Server for SAP Applications)
15 SP3 (Suse Linux Enterprise Desktop)
15 SP2 (Suse Linux Enterprise Server)
15 SP2 (SUSE Linux Enterprise Server for SAP Applications)
- (Альт 8 СП)
15 SP4 (Suse Linux Enterprise Server)
11 (Red Hat build of OpenJDK)
1.8 (Red Hat build of OpenJDK)
15 SP2 (Suse Linux Enterprise Desktop)
15 SP4 (Suse Linux Enterprise Desktop)
8u301 (Java SE)
15 (Suse Linux Enterprise Server)
15 SP2-BCL (Suse Linux Enterprise Server)
15 SP4 (SUSE Linux Enterprise Server for SAP Applications)
20.3.3 (GraalVM Enterprise Edition)
21.2.0 (GraalVM Enterprise Edition)
15 SP2-LTSS (Suse Linux Enterprise Server)
15 SP1 (Suse Linux Enterprise Desktop)
15 (Suse Linux Enterprise Desktop)
до 2.5 (ОСОН ОСнова Оnyx)
15 SP3-LTSS (Suse Linux Enterprise Server)
15 SP5 (SUSE Linux Enterprise Server for SAP Applications)
15 SP5 (Suse Linux Enterprise Server)
15 SP5 (Suse Linux Enterprise Desktop)
18.04 ESM (Ubuntu)
7u311 (Java SE)
11.0.12 (Java SE)
7u311 (OpenJDK)
8u302 (OpenJDK)
11.0.12 (OpenJDK)
13.0.8 (OpenJDK)
15.0.4 (OpenJDK)
16.0.2 (OpenJDK)
7 Supplementary (Red Hat Enterprise Linux)
до 20.10.2023 (ОС ОН «Стрелец»)

Тип ПО

Операционная система
Прикладное ПО информационных систем

Операционные системы и аппаратные платформы

Red Hat Inc. Red Hat Enterprise Linux 7
Novell Inc. Suse Linux Enterprise Desktop 12 SP3
Novell Inc. Suse Linux Enterprise Desktop 12 SP4
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP2
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP3
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP4
Novell Inc. Suse Linux Enterprise Server 12 SP4
Red Hat Inc. Red Hat Enterprise Linux 8
Novell Inc. Suse Linux Enterprise Server 12 SP2-BCL
Novell Inc. Suse Linux Enterprise Server 12 SP2-ESPOS
Novell Inc. Suse Linux Enterprise Server 12-LTSS
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP1
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP1
Novell Inc. Suse Linux Enterprise Server 12 SP1-LTSS
Novell Inc. Suse Linux Enterprise Server 12 SP2-LTSS
Novell Inc. Suse Linux Enterprise Server 12 SP3-LTSS
Novell Inc. Suse Linux Enterprise Server 12 SP3-BCL
Novell Inc. Suse Linux Enterprise Server 12 SP5
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP5
Сообщество свободного программного обеспечения Debian GNU/Linux 10
Novell Inc. Suse Linux Enterprise Server 12 SP3-ESPOS
Novell Inc. Suse Linux Enterprise Desktop 12 SP2
Novell Inc. Suse Linux Enterprise Server 12 SP2
Novell Inc. Suse Linux Enterprise Server 15-LTSS
Novell Inc. Suse Linux Enterprise Desktop 12 SP1
Novell Inc. Suse Linux Enterprise Server 12 SP1
Canonical Ltd. Ubuntu 20.04 LTS
Novell Inc. Suse Linux Enterprise Desktop 12
Novell Inc. OpenSUSE Leap 15.2
Red Hat Inc. Red Hat Enterprise Linux 8.1 Extended Update Support
Novell Inc. Suse Linux Enterprise Server 12 SP4-ESPOS
Fedora Project Fedora 33
Red Hat Inc. Red Hat Enterprise Linux 8.2 Extended Update Support
Novell Inc. Suse Linux Enterprise Server 12 SP4-LTSS
Canonical Ltd. Ubuntu 21.04
Novell Inc. Suse Linux Enterprise Server 15 SP1-BCL
Novell Inc. Suse Linux Enterprise Server 15 SP1-LTSS
Fedora Project Fedora 34
Canonical Ltd. Ubuntu 16.04 ESM
Novell Inc. OpenSUSE Leap 15.3
Novell Inc. Suse Linux Enterprise Server 15 SP1
Сообщество свободного программного обеспечения Debian GNU/Linux 11
Fedora Project Fedora 35
Canonical Ltd. Ubuntu 21.10
Novell Inc. Suse Linux Enterprise Server 12
ООО «Ред Софт» РЕД ОС 7.3
Novell Inc. OpenSUSE Leap 15.4
Novell Inc. Suse Linux Enterprise Server 15 SP3
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP3
Novell Inc. Suse Linux Enterprise Desktop 15 SP3
Novell Inc. Suse Linux Enterprise Server 15 SP2
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP2
АО «ИВК» Альт 8 СП -
Novell Inc. Suse Linux Enterprise Server 15 SP4
Novell Inc. Suse Linux Enterprise Desktop 15 SP2
Novell Inc. Suse Linux Enterprise Desktop 15 SP4
Novell Inc. Suse Linux Enterprise Server 15
Novell Inc. Suse Linux Enterprise Server 15 SP2-BCL
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP4
Novell Inc. Suse Linux Enterprise Server 15 SP2-LTSS
Novell Inc. Suse Linux Enterprise Desktop 15 SP1
Novell Inc. Suse Linux Enterprise Desktop 15
АО "НППКТ" ОСОН ОСнова Оnyx до 2.5
Novell Inc. Suse Linux Enterprise Server 15 SP3-LTSS
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP5
Novell Inc. Suse Linux Enterprise Server 15 SP5
Novell Inc. Suse Linux Enterprise Desktop 15 SP5
Canonical Ltd. Ubuntu 18.04 ESM
Red Hat Inc. Red Hat Enterprise Linux 7 Supplementary
АО «Концерн ВНИИНС» ОС ОН «Стрелец» до 20.10.2023

Уровень опасности уязвимости

Средний уровень опасности (базовая оценка CVSS 2.0 составляет 5,4)
Средний уровень опасности (базовая оценка CVSS 3.0 составляет 5,9)

Возможные меры по устранению уязвимости

Использование рекомендаций:
Для программных продуктов Oracle Corp.:
https://www.oracle.com/security-alerts/cpuoct2021.html
Для OpenJDK:
https://openjdk.org/groups/vulnerability/advisories/2021-10-19
Для программных продуктов Ubuntu:
https://ubuntu.com/security/CVE-2021-35550
https://ubuntu.com/security/notices/USN-5202-1
Для программных продуктов Debian GNU/Linux:
https://security-tracker.debian.org/tracker/CVE-2021-35550
Для программных продуктов Red Hat Inc.:
https://access.redhat.com/security/cve/cve-2021-35550
Для программных продуктов Novell Inc.:
https://www.suse.com/security/cve/CVE-2021-35550.html
Для программных продуктов Fedora:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/
Для Альт 8 СП:
https://cve.basealt.ru/report-27102021-c9f1.html
https://cve.basealt.ru/report-25102021-c9f2.html
Для ОСОН ОСнова Оnyx:
Обновление программного обеспечения openjdk-11 до версии 11.0.15+10.repack-1~deb10u1.osnova18
Для ОС ОН «Стрелец»:
Обновление программного обеспечения openjdk-8 до версии 8u332-ga-repack1+deb9u1.osnova12
Для РедОС: http://repo.red-soft.ru/redos/7.3c/x86_64/updates/

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Уязвимость устранена

Ссылки на источники

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 27%
0.00093
Низкий

5.9 Medium

CVSS3

5.4 Medium

CVSS2

Связанные уязвимости

CVSS3: 5.9
ubuntu
больше 3 лет назад

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score ...

CVSS3: 5.9
redhat
больше 3 лет назад

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score ...

CVSS3: 5.9
nvd
больше 3 лет назад

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.9

CVSS3: 5.9
debian
больше 3 лет назад

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition produc ...

CVSS3: 5.9
github
около 3 лет назад

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score ...

EPSS

Процентиль: 27%
0.00093
Низкий

5.9 Medium

CVSS3

5.4 Medium

CVSS2