CVE-2021-2351

HOCH 8.3CVE-2021-2351 · Published 21/07/2021 · updated 25/08/2026

Package	Affected versions	Patched versions
advanced networking option oracle	`= 12.1.0.2= 12.2.0.1= 19c`	No fix yet
agile engineering data management oracle	`= 6.2.1.0`	No fix yet
agile product lifecycle management oracle	`= 9.3.6`	No fix yet
agile product lifecycle management for process oracle	`= 6.2.2.0= 6.2.3.0`	No fix yet
airlines data model oracle	`= 12.1.1.0.0= 12.2.0.1.0`	No fix yet
application performance management oracle	`= 13.4.1.0= 13.5.1.0`	No fix yet
application testing suite oracle	`= 13.3.0.1`	No fix yet
argus analytics oracle	`= 8.2.1= 8.2.2= 8.2.3`	No fix yet
argus insight oracle	`= 8.2.1= 8.2.2= 8.2.3`	No fix yet
argus mart oracle	`= 8.2.1= 8.2.2= 8.2.3`	No fix yet
argus safety oracle	`= 8.2.1= 8.2.2= 8.2.3`	No fix yet
banking apis oracle	`= 19.1= 19.2= 20.1= 21.1≥ 18.1, ≤ 18.3`	No fix yet
banking digital experience oracle	`= 17.2= 19.1= 19.2= 20.1= 21.1≥ 18.1, ≤ 18.3`	No fix yet
banking enterprise default management oracle	`= 2.10.0= 2.12.0`	No fix yet
banking platform oracle	`= 2.12.0= 2.6.2= 2.7.1`	No fix yet
big data spatial and graph oracle	`< 23.1`	`23.1`
blockchain platform oracle	`= 21.1.2`	No fix yet
clinical oracle	`= 5.2.1= 5.2.2`	No fix yet
commerce platform oracle	`= 11.3.0= 11.3.1= 11.3.2`	No fix yet
communications application session controller oracle	`= 3.9.0`	No fix yet
communications billing and revenue management oracle	`= 12.0.0.4= 12.0.0.5`	No fix yet
communications calendar server oracle	`= 8.0.0.5.0`	No fix yet
communications contacts server oracle	`= 8.0.0.3.0`	No fix yet
communications convergent charging controller oracle	`= 6.0.1.0.0≥ 12.0.1.0.0, ≤ 12.0.4.0.0`	No fix yet
communications data model oracle	`= 11.3.2.1.0= 11.3.2.2.0= 11.3.2.3.0= 12.1.0.1.0= 12.1.2.0.0`	No fix yet
communications design studio oracle	`= 7.3.5= 7.4.0= 7.4.1= 7.4.2`	No fix yet
communications diameter intelligence hub oracle	`≥ 8.0.0, ≤ 8.2.3`	No fix yet
communications ip service activator oracle	`= 7.4.0`	No fix yet
communications metasolv solution oracle	`= 6.3.1`	No fix yet
communications network charging and control oracle	`= 6.0.1.0.0≥ 12.0.1.0, ≤ 12.0.4.0.0`	No fix yet
communications network integrity oracle	`= 7.3.5= 7.3.6`	No fix yet
communications pricing design center oracle	`= 12.0.0.4= 12.0.0.5`	No fix yet
communications services gatekeeper oracle	`= 7.0`	No fix yet
communications session report manager oracle	`≥ 8.0.0, ≤ 8.2.5.0`	No fix yet
communications session route manager oracle	`≥ 8.2.0, ≤ 8.2.5`	No fix yet
data integrator oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet
demantra demand management oracle	`≥ 12.2.6, ≤ 12.2.11`	No fix yet
documaker oracle	`= 12.6.0= 12.7.0≥ 12.6.2, ≤ 12.6.4`	No fix yet
enterprise data quality oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet
enterprise manager base platform oracle	`= 13.4.0.0= 13.5.0.0`	No fix yet
enterprise manager ops center oracle	`= 12.4.0.0`	No fix yet
financial services analytical applications infrastructure oracle	`≥ 8.0.7, ≤ 8.1.1`	No fix yet
financial services behavior detection platform oracle	`= 8.0.11= 8.0.7= 8.0.8`	No fix yet
financial services enterprise case management oracle	`= 8.0.11= 8.0.7= 8.0.8`	No fix yet
financial services foreign account tax compliance act management oracle	`= 8.0.11= 8.0.7= 8.0.8`	No fix yet
financial services model management and governance oracle	`≥ 8.0.8.0.0, ≤ 8.1.1.0.0`	No fix yet
financial services trade-based anti money laundering oracle	`= 8.0.7= 8.0.8`	No fix yet
flexcube investor servicing oracle	`= 12.0.4= 12.1.0= 12.3.0= 12.4.0= 14.4.0= 14.5.0`	No fix yet
flexcube private banking oracle	`= 12.0.0= 12.1.0`	No fix yet
fusion middleware oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet
goldengate oracle	`≥ 19.1.0.0.1, < 21.5.0.0.220118< 12.3.0.1.0`	`21.5.0.0.22011812.3.0.1.0`
goldengate application adapters oracle	`< 23.1`	`23.1`
graph server and client oracle	`< 21.4.0`	`21.4.0`
health sciences clinical development analytics oracle	`= 4.0.1`	No fix yet
health sciences inform crf submit oracle	`= 6.2.1`	No fix yet
health sciences information manager oracle	`= 3.0.2= 3.0.3`	No fix yet
healthcare data repository oracle	`= 7.0.2= 8.1.0= 8.1.1`	No fix yet
healthcare foundation oracle	`≥ 7.3.0, ≤ 7.3.0.2≥ 8.0.0, ≤ 8.0.2≥ 8.1.0, ≤ 8.1.1`	No fix yet
healthcare translational research oracle	`= 4.1.0`	No fix yet
hospitality inventory management oracle	`= 9.1.0< 9.1.0`	`9.1.0`
hospitality opera 5 oracle	`= 5.6`	No fix yet
hospitality reporting and analytics oracle	`= 9.1.0`	No fix yet
hospitality suite8 oracle	`= 8.10.2= 8.11.0= 8.12.0= 8.13.0= 8.14.0`	No fix yet
hyperion infrastructure technology oracle	`= 11.2.7.0`	No fix yet
ilearning oracle	`= 6.2= 6.3`	No fix yet
instantis enterprisetrack oracle	`= 17.1= 17.2= 17.3`	No fix yet
insurance data gateway oracle	`= 11.0.2= 11.1.0= 11.2.7= 11.3.0= 11.3.1`	No fix yet
insurance insbridge rating and underwriting oracle	`= 5.2.0≥ 5.4, ≤ 5.6.0`	No fix yet
insurance policy administration oracle	`= 11.0.2= 11.1.0= 11.2.7= 11.3.0= 11.3.1`	No fix yet
insurance rules palette oracle	`= 11.0.2= 11.1.0= 11.2.7= 11.3.0= 11.3.1`	No fix yet
jd edwards enterpriseone tools oracle	`= 9.2.6.3`	No fix yet
oss support tools oracle	`< 2.12.42`	`2.12.42`
peoplesoft enterprise peopletools oracle	`= 8.57= 8.58= 8.59`	No fix yet
policy automation oracle	`≥ 12.2.0, ≤ 12.2.24`	No fix yet
primavera analytics oracle	`= 18.8.3.3= 19.12.11.1= 20.12.12.0`	No fix yet
primavera data warehouse oracle	`= 18.8.3.3= 19.12.11.1= 20.12.12.0`	No fix yet
primavera gateway oracle	`≥ 17.12.0, ≤ 17.12.11≥ 18.8.0, ≤ 18.8.12≥ 19.12.0, ≤ 19.12.11≥ 20.12.0, ≤ 20.12.7`	No fix yet
primavera p6 enterprise project portfolio management oracle	`≥ 17.12.0.0, ≤ 17.12.20≥ 18.8.0.0, ≤ 18.8.24≥ 19.12.0.0, ≤ 19.12.17.0≥ 20.12.0.0, ≤ 20.12.9.0`	No fix yet
primavera p6 professional project management oracle	`≥ 17.12, ≤ 17.12.20.0≥ 18.8, ≤ 18.8.24.0≥ 19.12.0.0, ≤ 19.12.17.0≥ 20.12.0.0, ≤ 20.12.9.0`	No fix yet
primavera unifier oracle	`= 18.8= 19.12= 20.12= 21.12≥ 17.7, ≤ 17.12`	No fix yet
product lifecycle analytics oracle	`= 3.6.1`	No fix yet
rapid planning oracle	`≥ 12.2.6, ≤ 12.2.11`	No fix yet
real user experience insight oracle	`= 13.4.1.0= 13.5.1.0`	No fix yet
retail analytics oracle	`≥ 16.0.0, ≤ 16.0.2`	No fix yet
retail assortment planning oracle	`= 16.0.3`	No fix yet
retail back office oracle	`= 14.1`	No fix yet
retail central office oracle	`= 14.1`	No fix yet
retail customer insights oracle	`≥ 16.0, ≤ 16.0.2`	No fix yet
retail extract transform and load oracle	`= 13.2.8`	No fix yet
retail financial integration oracle	`= 14.1.3.2= 15.0.3.1= 16.0.3.0= 19.0.1`	No fix yet
retail integration bus oracle	`= 14.1.3.2= 15.0.3.1= 16.0.3= 19.0.1`	No fix yet
retail merchandising system oracle	`= 19.0.1`	No fix yet
retail order broker oracle	`= 16.0= 18.0= 19.1`	No fix yet
retail order management system oracle	`= 19.5`	No fix yet
retail point-of-service oracle	`= 14.1`	No fix yet
retail predictive application server oracle	`= 14.1.3= 15.0.3= 16.0.3`	No fix yet
retail price management oracle	`= 14.1= 15.0= 16.0`	No fix yet
retail returns management oracle	`= 14.1`	No fix yet
retail service backbone oracle	`= 14.1.3.2= 15.0.3.1= 16.0.3= 19.0.1`	No fix yet
retail store inventory management oracle	`= 14.1= 15.0= 16.0`	No fix yet
retail xstore point of service oracle	`= 17.0.4= 18.0.3= 19.0.2= 20.0.1`	No fix yet
siebel ui framework oracle	`≤ 21.12`	No fix yet
spatial studio oracle	`< 21.2.1`	`21.2.1`
storagetek acsls oracle	`= 8.5.1`	No fix yet
storagetek tape analytics oracle	`= 2.4`	No fix yet
thesaurus management system oracle	`= 5.2.3= 5.3.0= 5.3.1`	No fix yet
timesten in-memory database oracle	`= 21.1.1.1.0< 21.1.1.1.0`	`21.1.1.1.0`
utilities framework oracle	`= 4.2.0.3.0= 4.4.0.0.0= 4.4.0.2.0= 4.4.0.3.0≥ 4.3.0.1.0, ≤ 4.3.0.6.0`	No fix yet
utilities testing accelerator oracle	`= 6.0.0.1.1= 6.0.0.2.2= 6.0.0.3.1`	No fix yet
weblogic server oracle	`= 12.2.1.3.0= 12.2.1.4.0= 14.1.1.0.0`	No fix yet
zfs storage application integration engineering software oracle	`= 1.3.3`	No fix yet

Description

Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Advanced Networking Option, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Advanced Networking Option. Note: The July 2021 Critical Patch Update introduces a number of Native Network Encryption changes to deal with vulnerability CVE-2021-2351 and prevent the use of weaker ciphers. Customers should review: "Changes in Native Network Encryption with the July 2021 Critical Patch Update" (Doc ID 2791571.1). CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).

References

packetstormsecurity.com/files/165255/Oracle-Database-Protection-Mechanism-Bypass.html · Exploit
packetstormsecurity.com/files/165258/Oracle-Database-Weak-NNE-Integrity-Key-Derivation.html · Exploit
seclists.org/fulldisclosure/2021/Dec/19 · Exploit
seclists.org/fulldisclosure/2021/Dec/20 · Exploit
oracle.com/security-alerts/cpuapr2022.html · Patch
oracle.com/security-alerts/cpujan2022.html · Patch
oracle.com/security-alerts/cpujan2023.html · Vendor Advisory
oracle.com/security-alerts/cpujul2021.html · Patch
oracle.com/security-alerts/cpujul2022.html · Vendor Advisory
oracle.com/security-alerts/cpuoct2021.html · Patch

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free