WaratekVRT Sign in

CVE-2021-2351 Oracle Advanced Networking Option

Affected softwareOracle Advanced Networking Option
Affected versions12.1.0.2, 12.2.0.1, 19c
Severity8.3 High CVSS 3.1 3 scores
Fixed inOracle Critical Patch Update July 2021
WeaknessCWE-327
Published21 Jul 2021
Updated2 Nov 2026

Description

Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Advanced Networking Option, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Advanced Networking Option. Note: The July 2021 Critical Patch Update introduces a number of Native Network Encryption changes to deal with vulnerability CVE-2021-2351 and prevent the use of weaker ciphers. Customers should review: "Changes in Native Network Encryption with the July 2021 Critical Patch Update" (Doc ID 2791571.1). CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).

CWE-384

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 5 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 2.4% chance in 30 days

Waratek protection

No exploit published

Within Waratek scope. In the sources we check, nobody has published exploit code for this CVE or reported it being exploited.

This is a proprietary Oracle product. Oracle's security advisory is the source of public detail for this CVE.

  • Protection none
  • Action not pursued
  • Review automated Upstream data
  • Record active
Decided by Nothing to build a rule from yet: no published exploit, no CISA record of exploitation and no source-level change to read
Finding This CVE affects a known product, but nothing published names a fix and nothing published shows an exploit. That is a statement about the evidence, not about the defect — it does not mean the vulnerability is unimportant or unreachable, only that neither of the two things VRT can act on exists.

CVSS

8.3 HIGH v3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 8.3 HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H secalert_us@oracle.com Secondary published
CVSS 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H NVD Secondary
CVSS 2.0 5.1 none AV:N/AC:H/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update April 2023 ↗ CPU 2023-Q2 Oracle iLearning / Installation (JDBC) (6.3.1)
Oracle Critical Patch Update January 2023 ↗ CPU 2023-Q1 Oracle Food and Beverage Applications / Reporting (9.1.0)
Oracle Critical Patch Update October 2022 ↗ CPU 2022-Q4 Oracle Communications / Security (OJDBC) (12.4.0)
Oracle Critical Patch Update July 2022 ↗ CPU 2022-Q3 Oracle Food and Beverage Applications / Installation (ODP for .NET) (9.1)
Oracle Fusion Middleware / Installer (OCCI) (12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0)
Oracle Supply Chain / Reporting (ODP for .NET) (6.2.2, 6.2.3)
Oracle TimesTen In-Memory Database / Oracle TimesTen In-Memory Database Cache (Prior to 22.1.1.1.0)
Oracle Critical Patch Update April 2022 ↗ CPU 2022-Q2 Oracle Blockchain Platform / BCS Console (JDBC, OCCI) (21.1.2)
Oracle's note: This is a hotfix on top of version 21.1.2
Oracle Communications / Integrated DIH (JDBC, OCCI) (8.0.0-8.2.3)
Oracle Communications / Third party software/products (JDBC) (7.0.0.0.0)
Oracle Communications Applications / Cloud Native Deployment (JDBC) (12.0.0.4, 12.0.0.5)
Oracle Communications Applications / Pipeline Configuration Center, Oracle Data Manager, Rated Event Loader (JDBC) (12.0.0.4, 12.0.0.5)
Oracle Communications Applications / Service Activator (OCCI) (7.4.0)
Oracle Enterprise Manager / Networking (OCCI) (12.4.0.0)
Oracle Financial Services Applications / Collections (JDBC) (2.10.0, 2.12.0)
Oracle Financial Services Applications / Security (JDBC) (2.6.2, 2.7.1, 2.12.0)
Oracle GoldenGate / General (OCCI) (Prior to 23.1)
Oracle Insurance Applications / Development Tools (JDBC, OCCI) (12.6.0, 12.6.2-12.6.4, 12.7.0)
Oracle JD Edwards / Database and Comm SEC (OCCI) (Prior to 9.2.6.3)
Oracle JD Edwards / Monitoring and Diagnostics SEC (JDBC) (Prior to 9.2.6.3)
Oracle Systems / Application Server (JDBC) (2.4)
Oracle Systems / Software (JDBC) (8.5.1)
Oracle Critical Patch Update January 2022 ↗ CPU 2022-Q1 Oracle Airlines Data Model / Installation (JDBC) (12.2.0.1.0, 12.1.1.0.0)
Oracle Big Data Graph / Big Data Graph (JDBC) (Prior to 23.1)
Oracle Commerce / Dynamo Application Framework (JDBC) (11.3.0, 11.3.1, 11.3.2)
Oracle Communications Applications / ACS (JDBC) (6.0.1.0.0, 12.0.1.0.0-12.0.4.0.0)
Oracle Communications Applications / ACS (JDBC) (6.0.1.0.0, 12.0.1.0.0-12.0.4.0.0)
Oracle Communications Applications / Administration (JDBC) (8.0.0.5.0)
Oracle Communications Applications / Database (JDBC) (8.0.0.3.0)
Oracle Communications Applications / Installer (JDBC) (7.3.5, 7.3.6)
Oracle Communications Applications / OSM, NI Plugins (JDBC) (7.3.5, 7.4.0, 7.4.1, 7.4.2)
Oracle Communications Data Model / Utilities (JDBC) (11.3.2.2.0, 12.1.2.0.0, 12.1.0.1.0, 11.3.2.3.0, 11.3.2.1.0)
Oracle Construction and Engineering / API component of P6 Pro (JDBC) (17.12.0.0-17.12.20.0, 18.8.0.0-18.8.24.0, 19.12.0.0-19.12.17.0, 20.12.0.0-20.12.9.0)
Oracle Construction and Engineering / ETL (JDBC) (18.8.3.3, 19.12.11.1, 20.12.12.0)
Oracle Construction and Engineering / ETL (JDBC) (18.8.3.3, 19.12.11.1, 20.12.12.0)
Oracle Construction and Engineering / Platform,Data Access,Data Persistence (JDBC) (17.7-17.12, 18.8, 19.12, 20.12, 21.12)
Oracle Construction and Engineering / Web Access (JDBC) (17.12.0.0-17.12.20.0, 18.8.0.0-18.8.24.0, 19.12.0.0-19.12.17.0, 20.12.0.0-20.12.9.0)
Oracle Enterprise Manager / End User Experience Management (JDBC) (13.4.1.0, 13.5.1.0)
Oracle Enterprise Manager / End User Experience Management (OCCI) (13.4.1.0, 13.5.1.0)
Oracle Enterprise Manager / Enterprise Manager Install (JDBC) (13.4.0.0, 13.5.0.0)
Oracle Enterprise Manager / Load Testing for Web Apps (JDBC, OCCI) (13.3.0.1)
Oracle Enterprise Manager / Networking (JDBC) (12.4.0.0)
Oracle Financial Services Applications / Framework (JDBC) (17.2, 18.1-18.3, 19.1, 19.2, 20.1, 21.1)
Oracle Financial Services Applications / Framework (JDBC) (18.1-18.3, 19.1, 19.2, 20.1, 21.1)
Oracle Financial Services Applications / Infrastructure Code (JDBC) (12.0.4, 12.1.0, 12.3.0, 12.4.0, 14.4.0, 14.5.0)
Oracle Financial Services Applications / Installation (JDBC) (8.0.7, 8.0.8, 8.1.1)
Oracle Financial Services Applications / Installer & Configuration (JDBC) (8.0.8-8.1.1)
Oracle Financial Services Applications / Installers (JDBC) (8.0.7, 8.0.8, 8.1.1)
Oracle Financial Services Applications / Miscellaneous (JDBC) (12.0.0, 12.1.0)
Oracle Financial Services Applications / Rate Management (JDBC) (8.0.7-8.1.1)
Oracle Financial Services Applications / Third Party (JDBC) (8.0.7, 8.0.8, 8.1.1)
Oracle Financial Services Applications / User Interface (JDBC) (8.0.7, 8.0.8)
Oracle Fusion Middleware / Centralized Third-party Jars (JDBC, OCCI, ODP for .NET) (12.2.1.3.0, 12.2.1.4.0)
Oracle Fusion Middleware / General (JDBC) (12.2.1.3.0, 12.2.1.4.0)
Oracle Fusion Middleware / Runtime Java agent for ODI (JDBC) (12.2.1.3.0, 12.2.1.4.0)
Oracle GoldenGate / Database (OCCI) (Prior to 21.5.0.0.220118, Prior to 19.1.0.0.220118, Prior to 12.3.0.1)
Oracle Graph Server and Client / Packaging/install issues (JDBC) (Prior to 21.4)
Oracle Health Sciences Applications / Installation (JDBC) (4.0.1)
Oracle Health Sciences Applications / Installation and Configuration (JDBC, ODP for .NET) (6.2.1)
Oracle Health Sciences Applications / Report Generation (JDBC) (5.2.3, 5.3.0, 5.3.1)
Oracle Health Sciences Applications / Schema Creation (JDBC) (5.2.1, 5.2.2)
Oracle Health Sciences Applications / Schema Creation (JDBC) (8.2.1, 8.2.2, 8.2.3)
Oracle Health Sciences Applications / Schema Creation (JDBC) (8.2.1, 8.2.2, 8.2.3)
Oracle Health Sciences Applications / Schema Creation (JDBC) (8.2.1, 8.2.2, 8.2.3)
Oracle Health Sciences Applications / Schema Creation (JDBC) (8.2.1, 8.2.2, 8.2.3)
Oracle HealthCare Applications / Health Policy Engine (JDBC) (3.0.2, 3.0.3)
Oracle HealthCare Applications / Installation (JDBC) (4.1.0)
Oracle HealthCare Applications / Installation (JDBC) (7.0.2, 8.1.0, 8.1.1)
Oracle HealthCare Applications / Installation (JDBC) (7.3.0.0-7.3.0.2, 8.0.0-8.0.2, 8.1.0-8.1.1)
Oracle Hospitality Applications / Integrations (JDBC, ODP for .NET) (5.6)
Oracle Hospitality Applications / Rest API (ODP for .NET) (8.10.2, 8.11.0, 8.12.0, 8.13.0, 8.14.0)
Oracle Hyperion / Installation and Configuration (JDBC, OCCI, ODP for .NET) (11.2.7.0)
Oracle Insurance Applications / Architecture (JDBC) (11.0.2, 11.1.0, 11.2.7, 11.3.0, 11.3.1)
Oracle Insurance Applications / Architecture (JDBC) (11.0.2, 11.1.0, 11.2.7, 11.3.0, 11.3.1)
Oracle Insurance Applications / Framework Administrator IBFA (JDBC, ODP for .NET) (5.2.0, 5.4.0-5.6.0)
Oracle Insurance Applications / Security (JDBC) (11.0.2, 11.1.0, 11.2.7, 11.3.0, 11.3.1)
Oracle PeopleSoft / Change Impact Analyzer (JDBC) (8.57, 8.58, 8.59)
Oracle Policy Automation / Determinations Engine (JDBC) (12.2.0-12.2.24)
Oracle Retail Applications / Application Core (JDBC) (16.0.3)
Oracle Retail Applications / Foundation (JDBC) (19.0.1)
Oracle Retail Applications / Mathematical Operators (JDBC) (13.2.8)
Oracle Retail Applications / Other (JDBC) (16.0.0-16.0.2)
Oracle Retail Applications / Other (JDBC) (16.0.0-16.0.2)
Oracle Retail Applications / PeopleSoft Integration Bugs (JDBC) (14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1)
Oracle Retail Applications / RIB Kernal (JDBC) (14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1)
Oracle Retail Applications / RPAS Server (OCCI) (14.1.3, 15.0.3, 16.0.3)
Oracle Retail Applications / RSB Installation (JDBC) (14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1)
Oracle Retail Applications / Security (JDBC) (14.1)
Oracle Retail Applications / Security (JDBC) (14.1)
Oracle Retail Applications / Security (JDBC) (14.1)
Oracle Retail Applications / Security (JDBC) (14.1)
Oracle Retail Applications / Security (JDBC) (14.1, 15, 16)
Oracle Retail Applications / System Administration (JDBC) (16.0, 18.0, 19.1)
Oracle Retail Applications / Upgrade Install (JDBC) (19.5)
Oracle Retail Applications / Xenvironment (JDBC) (17.0.4, 18.0.3, 19.0.2, 20.0.1)
Oracle Siebel CRM / EAI (JDBC) (21.12 and prior)
Oracle Spatial Studio / Install (JDBC) (Prior to 21.2.1)
Oracle Supply Chain / Installation (JDBC) (3.6.1)
Oracle Supply Chain / Installation (JDBC) (6.2.1.0)
Oracle Supply Chain / Middle Tier (JDBC, OCCI) (12.2.6-12.2.11)
Oracle Supply Chain / Security (JDBC) (9.3.6)
Oracle Supply Chain / Security (JDBC, OCCI) (12.2.6-12.2.11)
Oracle Support Tools / Diagnostic Assistant (JDBC) (Prior to 2.12.42)
Oracle Systems / Snap Management Utility (JDBC) (1.3.3)
Oracle TimesTen In-Memory Database / EM TimesTen plug-in (JDBC,OCCI) (Prior to 21.1.1.1.0)
Oracle Utilities Applications / General (JDBC) (4.2.0.3.0, 4.3.0.1.0-4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0)
Oracle Utilities Applications / Tools (JDBC) (6.0.0.1.1, 6.0.0.2.2, 6.0.0.3.1)
Oracle iLearning / Installation (JDBC) (6.2, 6.3)
Oracle Critical Patch Update October 2021 ↗ CPU 2021-Q4 Oracle Communications / Reports (JDBC) (8.0.0.0-8.2.5.0)
Oracle Communications / Route Manager (JDBC) (8.2.0.0-8.2.5.0)
Oracle Communications / Signaling (JDBC) (3.9)
Oracle Communications Applications / Reports (JDBC) (6.3.1)
Oracle Construction and Engineering / Admin (JDBC) (17.12.0-17.12.11, 18.8.0-18.8.12, 19.12.0-19.12.11, 20.12.0-20.12.7)
Oracle Construction and Engineering / Core (JDBC) (17.1, 17.2, 17.3)
Oracle Enterprise Manager / End User Experience Management (JDBC) (13.5.1.0, 13.4.1.0)
Oracle Retail Applications / SIM Integration (JDBC) (14.1, 15.0, 16.0)
Oracle Critical Patch Update July 2021 ↗ CPU 2021-Q3 Oracle Database Server / Advanced Networking Option (12.1.0.2, 12.2.0.1, 19c)
Oracle's note: The July 2021 Critical Patch Update introduces a number of Native Network Encryption changes to deal with vulnerability CVE-2021-2351 and prevent the use of weaker ciphers. Customers should review: “Changes in Native Network Encryption with the July 2021 Critical Patch Update” ( Doc ID 2791571.1 ).

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Airlines Data Model Installation (JDBC) 12.2.0.1.0, 12.1.1.0.0 12.1.1.0.0 · 12.2.0.1.0
Oracle Big Data Graph Big Data Graph (JDBC) Prior to 23.1
Oracle Blockchain Platform BCS Console (JDBC, OCCI) 21.1.2 21.1.2
Oracle Commerce Dynamo Application Framework (JDBC) 11.3.0, 11.3.1, 11.3.2 11.3.0 · 11.3.1 · 11.3.2
Oracle Communications Integrated DIH (JDBC, OCCI) 8.0.0-8.2.3
Oracle Communications Reports (JDBC) 8.0.0.0-8.2.5.0
Oracle Communications Route Manager (JDBC) 8.2.0.0-8.2.5.0
Oracle Communications Security (OJDBC) 12.4.0 12.4.0
Oracle Communications Signaling (JDBC) 3.9 3.9
Oracle Communications Third party software/products (JDBC) 7.0.0.0.0 7.0.0.0.0
Oracle Communications Applications ACS (JDBC) 6.0.1.0.0, 12.0.1.0.0-12.0.4.0.0 6.0.1.0.0
Oracle Communications Applications Administration (JDBC) 8.0.0.5.0 8.0.0.5.0
Oracle Communications Applications Cloud Native Deployment (JDBC) 12.0.0.4, 12.0.0.5 12.0.0.4 · 12.0.0.5
Oracle Communications Applications Database (JDBC) 8.0.0.3.0 8.0.0.3.0
Oracle Communications Applications Installer (JDBC) 7.3.5, 7.3.6 7.3.5 · 7.3.6
Oracle Communications Applications OSM, NI Plugins (JDBC) 7.3.5, 7.4.0, 7.4.1, 7.4.2 7.3.5 · 7.4.0 · 7.4.1 · 7.4.2
Oracle Communications Applications Pipeline Configuration Center, Oracle Data Manager, Rated Event Loader (JDBC) 12.0.0.4, 12.0.0.5 12.0.0.4 · 12.0.0.5
Oracle Communications Applications Reports (JDBC) 6.3.1 6.3.1
Oracle Communications Applications Service Activator (OCCI) 7.4.0 7.4.0
Oracle Communications Data Model Utilities (JDBC) 11.3.2.2.0, 12.1.2.0.0, 12.1.0.1.0, 11.3.2.3.0, 11.3.2.1.0 11.3.2.1.0 · 11.3.2.2.0 · 11.3.2.3.0 · 12.1.0.1.0 · 12.1.2.0.0
Oracle Construction and Engineering API component of P6 Pro (JDBC) 17.12.0.0-17.12.20.0, 18.8.0.0-18.8.24.0, 19.12.0.0-19.12.17.0, 20.12.0.0-20.12.9.0
Oracle Construction and Engineering Admin (JDBC) 17.12.0-17.12.11, 18.8.0-18.8.12, 19.12.0-19.12.11, 20.12.0-20.12.7
Oracle Construction and Engineering Core (JDBC) 17.1, 17.2, 17.3 17.1 · 17.2 · 17.3
Oracle Construction and Engineering ETL (JDBC) 18.8.3.3, 19.12.11.1, 20.12.12.0 18.8.3.3 · 19.12.11.1 · 20.12.12.0
Oracle Construction and Engineering Platform,Data Access,Data Persistence (JDBC) 17.7-17.12, 18.8, 19.12, 20.12, 21.12 18.8 · 19.12 · 20.12 · 21.12
Oracle Construction and Engineering Web Access (JDBC) 17.12.0.0-17.12.20.0, 18.8.0.0-18.8.24.0, 19.12.0.0-19.12.17.0, 20.12.0.0-20.12.9.0
Oracle Database Server Advanced Networking Option 12.1.0.2, 12.2.0.1, 19c 12.1.0.2 · 12.2.0.1 · 19
Oracle Enterprise Manager End User Experience Management (JDBC) 13.4.1.0, 13.5.1.0 13.4.1.0 · 13.5.1.0
Oracle Enterprise Manager End User Experience Management (OCCI) 13.4.1.0, 13.5.1.0 13.4.1.0 · 13.5.1.0
Oracle Enterprise Manager Enterprise Manager Install (JDBC) 13.4.0.0, 13.5.0.0 13.4.0.0 · 13.5.0.0
Oracle Enterprise Manager Load Testing for Web Apps (JDBC, OCCI) 13.3.0.1 13.3.0.1
Oracle Enterprise Manager Networking (JDBC) 12.4.0.0 12.4.0.0
Oracle Enterprise Manager Networking (OCCI) 12.4.0.0 12.4.0.0
Oracle Financial Services Applications Collections (JDBC) 2.10.0, 2.12.0 2.10.0 · 2.12.0
Oracle Financial Services Applications Framework (JDBC) 17.2, 18.1-18.3, 19.1, 19.2, 20.1, 21.1 17.2 · 19.1 · 19.2 · 20.1 · 21.1
Oracle Financial Services Applications Infrastructure Code (JDBC) 12.0.4, 12.1.0, 12.3.0, 12.4.0, 14.4.0, 14.5.0 12.0.4 · 12.1.0 · 12.3.0 · 12.4.0 · 14.4.0 · 14.5.0
Oracle Financial Services Applications Installation (JDBC) 8.0.7, 8.0.8, 8.1.1 8.0.7 · 8.0.8 · 8.1.1
Oracle Financial Services Applications Installer & Configuration (JDBC) 8.0.8-8.1.1
Oracle Financial Services Applications Installers (JDBC) 8.0.7, 8.0.8, 8.1.1 8.0.7 · 8.0.8 · 8.1.1
Oracle Financial Services Applications Miscellaneous (JDBC) 12.0.0, 12.1.0 12.0.0 · 12.1.0
Oracle Financial Services Applications Rate Management (JDBC) 8.0.7-8.1.1
Oracle Financial Services Applications Security (JDBC) 2.6.2, 2.7.1, 2.12.0 2.6.2 · 2.7.1 · 2.12.0
Oracle Financial Services Applications Third Party (JDBC) 8.0.7, 8.0.8, 8.1.1 8.0.7 · 8.0.8 · 8.1.1
Oracle Financial Services Applications User Interface (JDBC) 8.0.7, 8.0.8 8.0.7 · 8.0.8
Oracle Food and Beverage Applications Installation (ODP for .NET) 9.1 9.1
Oracle Food and Beverage Applications Reporting 9.1.0 9.1.0
Oracle Fusion Middleware Centralized Third-party Jars (JDBC, OCCI, ODP for .NET) 12.2.1.3.0, 12.2.1.4.0 12.2.1.3.0 · 12.2.1.4.0
Oracle Fusion Middleware General (JDBC) 12.2.1.3.0, 12.2.1.4.0 12.2.1.3.0 · 12.2.1.4.0
Oracle Fusion Middleware Installer (OCCI) 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0
Oracle Fusion Middleware Runtime Java agent for ODI (JDBC) 12.2.1.3.0, 12.2.1.4.0 12.2.1.3.0 · 12.2.1.4.0
Oracle GoldenGate Database (OCCI) Prior to 21.5.0.0.220118, Prior to 19.1.0.0.220118, Prior to 12.3.0.1
Oracle GoldenGate General (OCCI) Prior to 23.1
Oracle Graph Server and Client Packaging/install issues (JDBC) Prior to 21.4
Oracle Health Sciences Applications Installation (JDBC) 4.0.1 4.0.1
Oracle Health Sciences Applications Installation and Configuration (JDBC, ODP for .NET) 6.2.1 6.2.1
Oracle Health Sciences Applications Report Generation (JDBC) 5.2.3, 5.3.0, 5.3.1 5.2.3 · 5.3.0 · 5.3.1
Oracle Health Sciences Applications Schema Creation (JDBC) 5.2.1, 5.2.2 5.2.1 · 5.2.2 · 8.2.1 · 8.2.2 · 8.2.3
Oracle HealthCare Applications Health Policy Engine (JDBC) 3.0.2, 3.0.3 3.0.2 · 3.0.3
Oracle HealthCare Applications Installation (JDBC) 7.3.0.0-7.3.0.2, 8.0.0-8.0.2, 8.1.0-8.1.1 4.1.0 · 7.0.2 · 8.1.0 · 8.1.1
Oracle Hospitality Applications Integrations (JDBC, ODP for .NET) 5.6 5.6
Oracle Hospitality Applications Rest API (ODP for .NET) 8.10.2, 8.11.0, 8.12.0, 8.13.0, 8.14.0 8.10.2 · 8.11.0 · 8.12.0 · 8.13.0 · 8.14.0
Oracle Hyperion Installation and Configuration (JDBC, OCCI, ODP for .NET) 11.2.7.0 11.2.7.0
Oracle Insurance Applications Architecture (JDBC) 11.0.2, 11.1.0, 11.2.7, 11.3.0, 11.3.1 11.0.2 · 11.1.0 · 11.2.7 · 11.3.0 · 11.3.1
Oracle Insurance Applications Development Tools (JDBC, OCCI) 12.6.0, 12.6.2-12.6.4, 12.7.0 12.6.0 · 12.7.0
Oracle Insurance Applications Framework Administrator IBFA (JDBC, ODP for .NET) 5.2.0, 5.4.0-5.6.0 5.2.0
Oracle Insurance Applications Security (JDBC) 11.0.2, 11.1.0, 11.2.7, 11.3.0, 11.3.1 11.0.2 · 11.1.0 · 11.2.7 · 11.3.0 · 11.3.1
Oracle JD Edwards Database and Comm SEC (OCCI) Prior to 9.2.6.3
Oracle JD Edwards Monitoring and Diagnostics SEC (JDBC) Prior to 9.2.6.3
Oracle PeopleSoft Change Impact Analyzer (JDBC) 8.57, 8.58, 8.59 8.57 · 8.58 · 8.59
Oracle Policy Automation Determinations Engine (JDBC) 12.2.0-12.2.24
Oracle Retail Applications Application Core (JDBC) 16.0.3 16.0.3
Oracle Retail Applications Foundation (JDBC) 19.0.1 19.0.1
Oracle Retail Applications Mathematical Operators (JDBC) 13.2.8 13.2.8
Oracle Retail Applications Other (JDBC) 16.0.0-16.0.2
Oracle Retail Applications PeopleSoft Integration Bugs (JDBC) 14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1 14.1.3.2 · 15.0.3.1 · 16.0.3 · 19.0.1
Oracle Retail Applications RIB Kernal (JDBC) 14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1 14.1.3.2 · 15.0.3.1 · 16.0.3 · 19.0.1
Oracle Retail Applications RPAS Server (OCCI) 14.1.3, 15.0.3, 16.0.3 14.1.3 · 15.0.3 · 16.0.3
Oracle Retail Applications RSB Installation (JDBC) 14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1 14.1.3.2 · 15.0.3.1 · 16.0.3 · 19.0.1
Oracle Retail Applications SIM Integration (JDBC) 14.1, 15.0, 16.0 14.1 · 15.0 · 16.0
Oracle Retail Applications Security (JDBC) 14.1 14.1 · 15 · 16
Oracle Retail Applications System Administration (JDBC) 16.0, 18.0, 19.1 16.0 · 18.0 · 19.1
Oracle Retail Applications Upgrade Install (JDBC) 19.5 19.5
Oracle Retail Applications Xenvironment (JDBC) 17.0.4, 18.0.3, 19.0.2, 20.0.1 17.0.4 · 18.0.3 · 19.0.2 · 20.0.1
Oracle Siebel CRM EAI (JDBC) 21.12 and prior
Oracle Spatial Studio Install (JDBC) Prior to 21.2.1
Oracle Supply Chain Installation (JDBC) 3.6.1 3.6.1 · 6.2.1.0
Oracle Supply Chain Middle Tier (JDBC, OCCI) 12.2.6-12.2.11
Oracle Supply Chain Reporting (ODP for .NET) 6.2.2, 6.2.3 6.2.2 · 6.2.3
Oracle Supply Chain Security (JDBC) 9.3.6 9.3.6
Oracle Supply Chain Security (JDBC, OCCI) 12.2.6-12.2.11
Oracle Support Tools Diagnostic Assistant (JDBC) Prior to 2.12.42
Oracle Systems Application Server (JDBC) 2.4 2.4
Oracle Systems Snap Management Utility (JDBC) 1.3.3 1.3.3
Oracle Systems Software (JDBC) 8.5.1 8.5.1
Oracle TimesTen In-Memory Database EM TimesTen plug-in (JDBC,OCCI) Prior to 21.1.1.1.0
Oracle TimesTen In-Memory Database Oracle TimesTen In-Memory Database Cache Prior to 22.1.1.1.0
Oracle Utilities Applications General (JDBC) 4.2.0.3.0, 4.3.0.1.0-4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0 4.2.0.3.0 · 4.4.0.0.0 · 4.4.0.2.0 · 4.4.0.3.0
Oracle Utilities Applications Tools (JDBC) 6.0.0.1.1, 6.0.0.2.2, 6.0.0.3.1 6.0.0.1.1 · 6.0.0.2.2 · 6.0.0.3.1
Oracle iLearning Installation (JDBC) 6.2, 6.3 6.2 · 6.3 · 6.3.1

Products and versions

111 products, 248 version entries
SourceVendorProductSchemeAffected versions
nvd oracle advanced networking option generic 12.1.0.2 · 12.2.0.1 · 19c
nvd oracle agile engineering data management generic 6.2.1.0
nvd oracle agile product lifecycle management generic 9.3.6
nvd oracle agile product lifecycle management for process generic 6.2.2.0 · 6.2.3.0
nvd oracle airlines data model generic 12.1.1.0.0 · 12.2.0.1.0
nvd oracle application performance management generic 13.4.1.0 · 13.5.1.0
nvd oracle application testing suite generic 13.3.0.1
nvd oracle argus analytics generic 8.2.1 · 8.2.2 · 8.2.3
nvd oracle argus insight generic 8.2.1 · 8.2.2 · 8.2.3
nvd oracle argus mart generic 8.2.1 · 8.2.2 · 8.2.3
nvd oracle argus safety generic 8.2.1 · 8.2.2 · 8.2.3
nvd oracle banking apis generic ≥ 18.1 and ≤ 18.3 · 19.1 · 19.2 · 20.1 · 21.1
nvd oracle banking digital experience generic 17.2 · ≥ 18.1 and ≤ 18.3 · 19.1 · 19.2 · 20.1 · 21.1
nvd oracle banking enterprise default management generic 2.10.0 · 2.12.0
nvd oracle banking platform generic 2.6.2 · 2.7.1 · 2.12.0
nvd oracle big data spatial and graph generic ＜ 23.1
nvd oracle blockchain platform generic 21.1.2
nvd oracle clinical generic 5.2.1 · 5.2.2
nvd oracle commerce platform generic 11.3.0 · 11.3.1 · 11.3.2
nvd oracle communications application session controller generic 3.9.0
nvd oracle communications billing and revenue management generic 12.0.0.4 · 12.0.0.5
nvd oracle communications calendar server generic 8.0.0.5.0
nvd oracle communications contacts server generic 8.0.0.3.0
nvd oracle communications convergent charging controller generic 6.0.1.0.0 · ≥ 12.0.1.0.0 and ≤ 12.0.4.0.0
nvd oracle communications data model generic 11.3.2.1.0 · 11.3.2.2.0 · 11.3.2.3.0 · 12.1.0.1.0 · 12.1.2.0.0
nvd oracle communications design studio generic 7.3.5 · 7.4.0 · 7.4.1 · 7.4.2
nvd oracle communications diameter intelligence hub generic ≥ 8.0.0 and ≤ 8.2.3
nvd oracle communications ip service activator generic 7.4.0
nvd oracle communications metasolv solution generic 6.3.1
nvd oracle communications network charging and control generic 6.0.1.0.0 · ≥ 12.0.1.0 and ≤ 12.0.4.0.0
nvd oracle communications network integrity generic 7.3.5 · 7.3.6
nvd oracle communications pricing design center generic 12.0.0.4 · 12.0.0.5
nvd oracle communications services gatekeeper generic 7.0
nvd oracle communications session report manager generic ≥ 8.0.0 and ≤ 8.2.5.0
nvd oracle communications session route manager generic ≥ 8.2.0 and ≤ 8.2.5
nvd oracle data integrator generic 12.2.1.3.0 · 12.2.1.4.0
nvd oracle demantra demand management generic ≥ 12.2.6 and ≤ 12.2.11
nvd oracle documaker generic 12.6.0 · ≥ 12.6.2 and ≤ 12.6.4 · 12.7.0
nvd oracle enterprise data quality generic 12.2.1.3.0 · 12.2.1.4.0
nvd oracle enterprise manager base platform generic 13.4.0.0 · 13.5.0.0
nvd oracle enterprise manager ops center generic 12.4.0.0
nvd oracle financial services analytical applications infrastructure generic ≥ 8.0.7 and ≤ 8.1.1
nvd oracle financial services behavior detection platform generic 8.0.7 · 8.0.8 · 8.0.11
nvd oracle financial services enterprise case management generic 8.0.7 · 8.0.8 · 8.0.11
nvd oracle financial services foreign account tax compliance act management generic 8.0.7 · 8.0.8 · 8.0.11
nvd oracle financial services model management and governance generic ≥ 8.0.8.0.0 and ≤ 8.1.1.0.0
nvd oracle financial services trade-based anti money laundering generic 8.0.7 · 8.0.8
nvd oracle flexcube investor servicing generic 12.0.4 · 12.1.0 · 12.3.0 · 12.4.0 · 14.4.0 · 14.5.0
nvd oracle flexcube private banking generic 12.0.0 · 12.1.0
nvd oracle fusion middleware generic 12.2.1.3.0 · 12.2.1.4.0
nvd oracle goldengate generic ＜ 12.3.0.1.0 · ≥ 19.1.0.0.1 and ＜ 21.5.0.0.99999
nvd oracle goldengate application adapters generic ＜ 23.1
nvd oracle graph server and client generic ＜ 21.4.0
nvd oracle health sciences clinical development analytics generic 4.0.1
nvd oracle health sciences inform crf submit generic 6.2.1
nvd oracle health sciences information manager generic 3.0.2 · 3.0.3
nvd oracle healthcare data repository generic 7.0.2 · 8.1.0 · 8.1.1
nvd oracle healthcare foundation generic ≥ 7.3.0 and ≤ 7.3.0.2 · ≥ 8.0.0 and ≤ 8.0.2 · ≥ 8.1.0 and ≤ 8.1.1
nvd oracle healthcare translational research generic 4.1.0
nvd oracle hospitality inventory management generic 9.1.0 · ＜ 9.1.0
nvd oracle hospitality opera 5 generic 5.6
nvd oracle hospitality reporting and analytics generic 9.1.0
nvd oracle hospitality suite8 generic 8.10.2 · 8.11.0 · 8.12.0 · 8.13.0 · 8.14.0
nvd oracle hyperion infrastructure technology generic 11.2.7.0
nvd oracle ilearning generic 6.2 · 6.3
nvd oracle instantis enterprisetrack generic 17.1 · 17.2 · 17.3
nvd oracle insurance data gateway generic 11.0.2 · 11.1.0 · 11.2.7 · 11.3.0 · 11.3.1
nvd oracle insurance insbridge rating and underwriting generic 5.2.0 · ≥ 5.4 and ≤ 5.6.0
nvd oracle insurance policy administration generic 11.0.2 · 11.1.0 · 11.2.7 · 11.3.0 · 11.3.1
nvd oracle insurance rules palette generic 11.0.2 · 11.1.0 · 11.2.7 · 11.3.0 · 11.3.1
nvd oracle jd edwards enterpriseone tools generic 9.2.6.3
nvd oracle oss support tools generic ＜ 2.12.42
nvd oracle peoplesoft enterprise peopletools generic 8.57 · 8.58 · 8.59
nvd oracle policy automation generic ≥ 12.2.0 and ≤ 12.2.24
nvd oracle primavera analytics generic 18.8.3.3 · 19.12.11.1 · 20.12.12.0
nvd oracle primavera data warehouse generic 18.8.3.3 · 19.12.11.1 · 20.12.12.0
nvd oracle primavera gateway generic ≥ 17.12.0 and ≤ 17.12.11 · ≥ 18.8.0 and ≤ 18.8.12 · ≥ 19.12.0 and ≤ 19.12.11 · ≥ 20.12.0 and ≤ 20.12.7
nvd oracle primavera p6 enterprise project portfolio management generic ≥ 17.12.0.0 and ≤ 17.12.20 · ≥ 18.8.0.0 and ≤ 18.8.24 · ≥ 19.12.0.0 and ≤ 19.12.17.0 · ≥ 20.12.0.0 and ≤ 20.12.9.0
nvd oracle primavera p6 professional project management generic ≥ 17.12 and ≤ 17.12.20.0 · ≥ 18.8 and ≤ 18.8.24.0 · ≥ 19.12.0.0 and ≤ 19.12.17.0 · ≥ 20.12.0.0 and ≤ 20.12.9.0
nvd oracle primavera unifier generic ≥ 17.7 and ≤ 17.12 · 18.8 · 19.12 · 20.12 · 21.12
nvd oracle product lifecycle analytics generic 3.6.1
nvd oracle rapid planning generic ≥ 12.2.6 and ≤ 12.2.11
nvd oracle real user experience insight generic 13.4.1.0 · 13.5.1.0
nvd oracle retail analytics generic ≥ 16.0.0 and ≤ 16.0.2
nvd oracle retail assortment planning generic 16.0.3
nvd oracle retail back office generic 14.1
nvd oracle retail central office generic 14.1
nvd oracle retail customer insights generic ≥ 16.0 and ≤ 16.0.2
nvd oracle retail extract transform and load generic 13.2.8
nvd oracle retail financial integration generic 14.1.3.2 · 15.0.3.1 · 16.0.3.0 · 19.0.1
nvd oracle retail integration bus generic 14.1.3.2 · 15.0.3.1 · 16.0.3 · 19.0.1
nvd oracle retail merchandising system generic 19.0.1
nvd oracle retail order broker generic 16.0 · 18.0 · 19.1
nvd oracle retail order management system generic 19.5
nvd oracle retail point-of-service generic 14.1
nvd oracle retail predictive application server generic 14.1.3 · 15.0.3 · 16.0.3
nvd oracle retail price management generic 14.1 · 15.0 · 16.0
nvd oracle retail returns management generic 14.1
nvd oracle retail service backbone generic 14.1.3.2 · 15.0.3.1 · 16.0.3 · 19.0.1
nvd oracle retail store inventory management generic 14.1 · 15.0 · 16.0
nvd oracle retail xstore point of service generic 17.0.4 · 18.0.3 · 19.0.2 · 20.0.1
nvd oracle siebel ui framework generic ≤ 21.12
nvd oracle spatial studio generic ＜ 21.2.1
nvd oracle storagetek acsls generic 8.5.1
nvd oracle storagetek tape analytics generic 2.4
nvd oracle thesaurus management system generic 5.2.3 · 5.3.0 · 5.3.1
nvd oracle timesten in-memory database generic 21.1.1.1.0 · ＜ 21.1.1.1.0
nvd oracle utilities framework generic 4.2.0.3.0 · ≥ 4.3.0.1.0 and ≤ 4.3.0.6.0 · 4.4.0.0.0 · 4.4.0.2.0 · 4.4.0.3.0
nvd oracle utilities testing accelerator generic 6.0.0.1.1 · 6.0.0.2.2 · 6.0.0.3.1
nvd oracle weblogic server generic 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0
nvd oracle zfs storage application integration engineering software generic 1.3.3

References

URLTags
http://packetstormsecurity.com/files/165255/Oracle-Database-Protection-Mechanism-Bypass.html Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/165258/Oracle-Database-Weak-NNE-Integrity-Key-Derivation.html Exploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2021/Dec/19 Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2021/Dec/20 Exploit, Mailing List, Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Vendor Advisory
https://www.oracle.com/security-alerts/cpujan2022.html Patch, Vendor Advisory
https://www.oracle.com/security-alerts/cpujan2023.html Vendor Advisory
https://www.oracle.com/security-alerts/cpujul2021.html Patch, Vendor Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Vendor Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html Patch, Vendor Advisory

Timeline
Published2021-07-21By the CVE Program.
NVD record modified2026-11-02NVD's own last-modified date for this record.