CVE-2021-35550
First published: Tue Oct 19 2021(Updated: )
An unspecified vulnerability in Java SE related to the JSSE component could allow an unauthenticated attacker to obtain sensitive information resulting in a high confidentiality impact using unknown attack vectors.
Credit: secalert_us@oracle.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/java | <1.8.0-openjdk-1:1.8.0.312.b07-1.el7_9 | 1.8.0-openjdk-1:1.8.0.312.b07-1.el7_9 |
| redhat/java | <11-openjdk-1:11.0.13.0.8-1.el7_9 | 11-openjdk-1:11.0.13.0.8-1.el7_9 |
| redhat/java | <1.8.0-ibm-1:1.8.0.7.5-1jpp.1.el7 | 1.8.0-ibm-1:1.8.0.7.5-1jpp.1.el7 |
| redhat/java | <1.7.1-ibm-1:1.7.1.5.5-1jpp.1.el7 | 1.7.1-ibm-1:1.7.1.5.5-1jpp.1.el7 |
| redhat/java | <11-openjdk-1:11.0.13.0.8-1.el8_4 | 11-openjdk-1:11.0.13.0.8-1.el8_4 |
| redhat/java | <1.8.0-openjdk-1:1.8.0.312.b07-1.el8_4 | 1.8.0-openjdk-1:1.8.0.312.b07-1.el8_4 |
| redhat/java | <1.8.0-ibm-1:1.8.0.7.5-1.el8_5 | 1.8.0-ibm-1:1.8.0.7.5-1.el8_5 |
| redhat/java | <1.8.0-openjdk-1:1.8.0.312.b07-1.el8_1 | 1.8.0-openjdk-1:1.8.0.312.b07-1.el8_1 |
| redhat/java | <11-openjdk-1:11.0.13.0.8-1.el8_1 | 11-openjdk-1:11.0.13.0.8-1.el8_1 |
| redhat/java | <1.8.0-openjdk-1:1.8.0.312.b07-1.el8_2 | 1.8.0-openjdk-1:1.8.0.312.b07-1.el8_2 |
| redhat/java | <11-openjdk-1:11.0.13.0.8-1.el8_2 | 11-openjdk-1:11.0.13.0.8-1.el8_2 |
| debian/openjdk-11 | 11.0.16+8-1~deb10u1 11.0.20+8-1~deb10u1 11.0.20+8-1~deb11u1 11.0.21+9-1 | |
| debian/openjdk-8 | 8u382-ga-2 | |
| IBM Cognos Analytics | <=12.0.0-12.0.1 | |
| IBM Cognos Analytics | <=11.2.0-11.2.4 FP2 | |
| IBM Cognos Analytics | <=11.1.1-11.1.7 FP7 | |
| Oracle GraalVM | =20.3.3 | |
| Oracle GraalVM | =21.2.0 | |
| Oracle Openjdk | =7-update311 | |
| Oracle Openjdk | =8-update301 | |
| Oracle Openjdk | =11.0.12 | |
| Netapp Active Iq Unified Manager Vmware Vsphere | ||
| Netapp Active Iq Unified Manager Windows | ||
| NetApp E-Series SANtricity OS Controller | >=11.0.0<=11.50.2 | |
| Netapp E-series Santricity Storage Manager | ||
| Netapp E-series Santricity Web Services Web Services Proxy | ||
| Netapp Hci Management Node | ||
| NetApp OnCommand Insight | ||
| Netapp Santricity Unified Manager | ||
| Netapp Snapmanager Oracle | ||
| Netapp Snapmanager Sap | ||
| Netapp Solidfire | ||
| Fedoraproject Fedora | =33 | |
| Fedoraproject Fedora | =34 | |
| Fedoraproject Fedora | =35 | |
| Debian Debian Linux | =9.0 | |
| Debian Debian Linux | =10.0 | |
| Debian Debian Linux | =11.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2021-35550 https://nvd.nist.gov/vuln/detail/CVE-2021-35550
- https://bugzilla.redhat.com/show_bug.cgi?id=2015648
- https://access.redhat.com/errata/RHSA-2021:3968
- https://access.redhat.com/errata/RHSA-2021:3960
- https://access.redhat.com/errata/RHSA-2021:3961
- https://access.redhat.com/errata/RHSA-2021:3889
- https://access.redhat.com/errata/RHSA-2021:3892
- https://access.redhat.com/errata/RHSA-2022:0968
- https://access.redhat.com/errata/RHSA-2022:0969
- https://access.redhat.com/errata/RHSA-2021:3891
- https://access.redhat.com/errata/RHSA-2021:3893
- https://access.redhat.com/errata/RHSA-2022:0970
- https://access.redhat.com/errata/RHSA-2021:3884
- https://access.redhat.com/errata/RHSA-2021:3886
- https://access.redhat.com/errata/RHSA-2021:3885
- https://access.redhat.com/errata/RHSA-2021:3887
- https://access.redhat.com/errata/RHSA-2021:3967
- https://access.redhat.com/security/cve/cve-2021-35550
- https://security-tracker.debian.org/tracker/CVE-2021-35550
- https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/
- https://security.gentoo.org/glsa/202209-05
- https://security.netapp.com/advisory/ntap-20211022-0004/
- https://www.debian.org/security/2021/dsa-5000
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://github.com/openjdk/jdk11u/commit/af4b37301d33723806c38cf8ae5d85b7fa7ef39f
- https://bugs.openjdk.java.net/browse/JDK-8163326
- https://www.oracle.com/java/technologies/javase/11-0-13-relnotes.html
- https://www.oracle.com/java/technologies/javase/8u311-relnotes.html
- https://www.oracle.com/security-alerts/cpuoct2021.html#AppendixJAVA
- https://github.com/openjdk/jdk11u-dev/commit/af4b37301d33723806c38cf8ae5d85b7fa7ef39f
- http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/f60ef263eb92
- https://exchange.xforce.ibmcloud.com/vulnerabilities/211627
- https://www.ibm.com/support/pages/node/7123154 (Advisory)
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is CVE-2021-35550?
CVE-2021-35550 is a vulnerability in the Java SE Oracle GraalVM Enterprise Edition product of Oracle Java SE.
Which versions of Java SE and Oracle GraalVM Enterprise Edition are affected?
Java SE versions 7u311, 8u301, 11.0.12, and Oracle GraalVM Enterprise Edition versions 20.3.3 and 21.2.0 are affected.
How severe is CVE-2021-35550?
CVE-2021-35550 has a severity rating of 5.9, which is considered medium.
How can I fix CVE-2021-35550?
To fix CVE-2021-35550, update to the following versions: Java SE 7u311, 8u301, or 11.0.12, or Oracle GraalVM Enterprise Edition 20.3.3 or 21.2.0.
Where can I find more information about CVE-2021-35550?
You can find more information about CVE-2021-35550 at the following references: [reference 1](https://github.com/openjdk/jdk11u/commit/af4b37301d33723806c38cf8ae5d85b7fa7ef39f), [reference 2](https://bugs.openjdk.java.net/browse/JDK-8163326), [reference 3](https://www.oracle.com/java/technologies/javase/11-0-13-relnotes.html).
- collector/redhat-cve
- collector/security-tracker-debian
- agent/type
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2021-35550
- agent/remedy
- agent/weakness
- agent/description
- agent/author
- agent/severity
- agent/references
- agent/event
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/redhat
- package-manager/debian
- vendor/ibm
- canonical/ibm cognos analytics
- version/ibm cognos analytics/12.0.0-12.0.1
- version/ibm cognos analytics/11.2.0-11.2.4 fp2
- version/ibm cognos analytics/11.1.1-11.1.7 fp7
- vendor/oracle
- canonical/oracle graalvm
- version/oracle graalvm/20.3.3
- version/oracle graalvm/21.2.0
- canonical/oracle openjdk
- version/oracle openjdk/7-update311
- version/oracle openjdk/8-update301
- version/oracle openjdk/11.0.12
- vendor/netapp
- canonical/netapp active iq unified manager vmware vsphere
- canonical/netapp active iq unified manager windows
- canonical/netapp e-series santricity os controller
- version/netapp e-series santricity os controller/11.0.0
- version/netapp e-series santricity os controller/11.50.2
- canonical/netapp e-series santricity storage manager
- canonical/netapp e-series santricity web services web services proxy
- canonical/netapp hci management node
- canonical/netapp oncommand insight
- canonical/netapp santricity unified manager
- canonical/netapp snapmanager oracle
- canonical/netapp snapmanager sap
- canonical/netapp solidfire
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/33
- version/fedoraproject fedora/34
- version/fedoraproject fedora/35
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- version/debian debian linux/10.0
- version/debian debian linux/11.0