CVE-2021-35564: Input Validation

Q: What is the vulnerability ID?

The vulnerability ID is CVE-2021-35564.

Q: What is the severity of CVE-2021-35564?

The severity of CVE-2021-35564 is medium with a CVSS score of 5.3.

Q: Which component of Java SE is affected by CVE-2021-35564?

The Keytool component of Java SE is affected by CVE-2021-35564.

Q: How can CVE-2021-35564 be exploited?

CVE-2021-35564 can be easily exploited without authentication.

Q: What are the affected versions of Java SE and Oracle GraalVM Enterprise Edition?

The affected versions of Java SE are 7u311, 8u301, 11.0.12, and 17. The affected versions of Oracle GraalVM Enterprise Edition are 20.3.3 and 21.2.0.

Q: How can I fix CVE-2021-35564?

To fix CVE-2021-35564, you should install the relevant patches or updates provided by Oracle or Red Hat.

Q: Where can I find more information about CVE-2021-35564?

You can find more information about CVE-2021-35564 on the Oracle and Red Hat websites.

Published Oct 18, 2021

Updated

A flaw was found in the way the Keytool component of OpenJDK handled X.509 certificates with validity period ending too far in the future, after year 9999. When such certificates were imported into a keystore, they could cause corruption of the keystore.

Other sources

An unspecified vulnerability in Java SE related to the Keytool component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact.

— IBM

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Keytool). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).

Affected Software

42 affected componentsFixes available

redhat/java<1.8.0-openjdk-1:1.8.0.312.b07-1.el7_9

1.8.0-openjdk-1:1.8.0.312.b07-1.el7_9

redhat/java<11-openjdk-1:11.0.13.0.8-1.el7_9

11-openjdk-1:11.0.13.0.8-1.el7_9

redhat/java<1.8.0-ibm-1:1.8.0.7.0-1jpp.1.el7

1.8.0-ibm-1:1.8.0.7.0-1jpp.1.el7

redhat/java<1.7.1-ibm-1:1.7.1.5.0-1jpp.1.el7

1.7.1-ibm-1:1.7.1.5.0-1jpp.1.el7

redhat/java<11-openjdk-1:11.0.13.0.8-1.el8_4

11-openjdk-1:11.0.13.0.8-1.el8_4

redhat/java<1.8.0-openjdk-1:1.8.0.312.b07-1.el8_4

1.8.0-openjdk-1:1.8.0.312.b07-1.el8_4

redhat/java<17-openjdk-1:17.0.1.0.12-2.el8_5

17-openjdk-1:17.0.1.0.12-2.el8_5

redhat/java<1.8.0-ibm-1:1.8.0.7.0-1.el8_5

1.8.0-ibm-1:1.8.0.7.0-1.el8_5

redhat/java<1.8.0-openjdk-1:1.8.0.312.b07-1.el8_1

1.8.0-openjdk-1:1.8.0.312.b07-1.el8_1

redhat/java<11-openjdk-1:11.0.13.0.8-1.el8_1

11-openjdk-1:11.0.13.0.8-1.el8_1

redhat/java<1.8.0-openjdk-1:1.8.0.312.b07-1.el8_2

1.8.0-openjdk-1:1.8.0.312.b07-1.el8_2

redhat/java<11-openjdk-1:11.0.13.0.8-1.el8_2

11-openjdk-1:11.0.13.0.8-1.el8_2

debian/openjdk-11

11.0.16+8-1~deb10u111.0.20+8-1~deb10u111.0.20+8-1~deb11u111.0.21+9-1

debian/openjdk-17

17.0.7+7-1~deb11u117.0.8+7-1~deb12u117.0.9+9-1

debian/openjdk-8

8u382-ga-2

IBM QRadar SIEM<=7.5.0 GA

IBM QRadar SIEM<=7.4.3 GA - 7.4.3 FP4

IBM QRadar SIEM<=7.3.3 GA - 7.3.3 FP10

Oracle GraalVM=20.3.3

Oracle GraalVM=21.2.0

Oracle OpenJDK=7-update311

Oracle OpenJDK=8-update301

Oracle OpenJDK=11.0.12

Oracle OpenJDK=17

NetApp Active Iq Unified Manager Vmware Vsphere

NetApp Active Iq Unified Manager Windows

NetApp E-Series SANtricity OS Controller>=11.0.0<=11.50.2

NetApp E-series Santricity Storage Manager

NetApp E-series Santricity Web Services Web Services Proxy

NetApp Hci Management Node

NetApp OnCommand Insight

NetApp OnCommand Workflow Automation

NetApp Santricity Unified Manager

NetApp Snapmanager Oracle

NetApp Snapmanager Sap

NetApp Solidfire

Fedoraproject Fedora=33

Fedoraproject Fedora=34

Fedoraproject Fedora=35

Debian Debian Linux=9.0

Debian Debian Linux=10.0

Debian Debian Linux=11.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 1.8.0-openjdk-1:1.8.0.312.b07-1.el7_9
Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 11-openjdk-1:11.0.13.0.8-1.el7_9
Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 1.8.0-ibm-1:1.8.0.7.0-1jpp.1.el7
Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 1.7.1-ibm-1:1.7.1.5.0-1jpp.1.el7
Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 11-openjdk-1:11.0.13.0.8-1.el8_4
Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 1.8.0-openjdk-1:1.8.0.312.b07-1.el8_4
Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 17-openjdk-1:17.0.1.0.12-2.el8_5
Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 1.8.0-ibm-1:1.8.0.7.0-1.el8_5
Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 1.8.0-openjdk-1:1.8.0.312.b07-1.el8_1
Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 11-openjdk-1:11.0.13.0.8-1.el8_1
Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 1.8.0-openjdk-1:1.8.0.312.b07-1.el8_2
Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 11-openjdk-1:11.0.13.0.8-1.el8_2
Upgrade
Upgrade debian/openjdk-11 to a version that resolves this vulnerability.
Fixed in 11.0.16+8-1~deb10u1Fixed in 11.0.20+8-1~deb10u1Fixed in 11.0.20+8-1~deb11u1Fixed in 11.0.21+9-1
Upgrade
Upgrade debian/openjdk-17 to a version that resolves this vulnerability.
Fixed in 17.0.7+7-1~deb11u1Fixed in 17.0.8+7-1~deb12u1Fixed in 17.0.9+9-1
Upgrade
Upgrade debian/openjdk-8 to a version that resolves this vulnerability.
Fixed in 8u382-ga-2
Upgrade
Upgrade Java SE (Keytool) to a version that resolves this vulnerability.
Fixed in 7u311
Upgrade
Upgrade Java SE (Keytool) to a version that resolves this vulnerability.
Fixed in 8u301
Upgrade
Upgrade Java SE (Keytool) to a version that resolves this vulnerability.
Fixed in 11.0.12
Upgrade
Upgrade Java SE (Keytool) to a version that resolves this vulnerability.
Fixed in 17
Upgrade
Upgrade Oracle GraalVM Enterprise Edition (Keytool) to a version that resolves this vulnerability.
Fixed in 20.3.3
Upgrade
Upgrade Oracle GraalVM Enterprise Edition (Keytool) to a version that resolves this vulnerability.
Fixed in 21.2.0
Compensating control
Avoid importing X.509 certificates with validity period end dates too far in the future (e.g., after year 9999) into Java SE/Oracle GraalVM key stores, since importing such certificates could corrupt the keystore.

Event History

Oct 18, 2021

Data Sourced

via Red Hat·10:24 AM

DescriptionSeverityAffected Software

Oct 19, 2021

CVE Published

12:00 AM

Oct 20, 2021

CVE Published

via MITRE·10:50 AM

Data Sourced

via MITRE·10:50 AM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is the vulnerability ID?