CVE-2021-2432: Medium severity ibm data risk manager vulnerability
An unspecified vulnerability in Java SE related to the JNDI component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.
Other sources
Oracle Java SE 7u311 fixes an unspecified vulnerability in the JNDI component (CVE-2021-2432). Upstream has CVSS scored this issue as: 3.7/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
https://www.oracle.com/security-alerts/cpujul2021.html#AppendixJAVA
— Red Hat
Vulnerability in the Java SE product of Oracle Java SE (component: JNDI). The supported version that is affected is Java SE: 7u301. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-2432?
CVE-2021-2432 is an unspecified vulnerability in Java SE related to the JNDI component.
How does CVE-2021-2432 impact the system?
CVE-2021-2432 allows an unauthenticated attacker to cause a denial of service resulting in a low availability impact.
What is the severity of CVE-2021-2432?
The severity of CVE-2021-2432 is medium, with a severity value of 3.7.
Which software is affected by CVE-2021-2432?
QRadar SIEM versions 7.5.0 GA, 7.4.3 GA - 7.4.3 FP4, and 7.3.3 GA - 7.3.3 FP10 are affected by CVE-2021-2432.
How do I fix CVE-2021-2432?
To fix CVE-2021-2432, apply the patches provided by IBM for the affected QRadar SIEM versions.