CVE-2021-35564: Input Validation
A flaw was found in the way the Keytool component of OpenJDK handled X.509 certificates with validity period ending too far in the future, after year 9999. When such certificates were imported into a keystore, they could cause corruption of the keystore.
Other sources
An unspecified vulnerability in Java SE related to the Keytool component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact.
— IBM
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Keytool). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-35564.
What is the severity of CVE-2021-35564?
The severity of CVE-2021-35564 is medium with a CVSS score of 5.3.
Which component of Java SE is affected by CVE-2021-35564?
The Keytool component of Java SE is affected by CVE-2021-35564.
How can CVE-2021-35564 be exploited?
CVE-2021-35564 can be easily exploited without authentication.
What are the affected versions of Java SE and Oracle GraalVM Enterprise Edition?
The affected versions of Java SE are 7u311, 8u301, 11.0.12, and 17. The affected versions of Oracle GraalVM Enterprise Edition are 20.3.3 and 21.2.0.
How can I fix CVE-2021-35564?
To fix CVE-2021-35564, you should install the relevant patches or updates provided by Oracle or Red Hat.
Where can I find more information about CVE-2021-35564?
You can find more information about CVE-2021-35564 on the Oracle and Red Hat websites.