CVE-2023-21896: High severity oracle solaris and zettabyte file system (zfs) vulnerability

Published Apr 18, 2023

Updated

Vulnerability in the Oracle Solaris product of Oracle Systems (component: NSSwitch). Supported versions that are affected are 10 and 11. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Affected Software

2 affected components

Oracle Solaris=10

Oracle Solaris=11

Remediation

Patch Available

https://www.oracle.com/security-alerts/cpuapr2023.html

Event History

Apr 18, 2023

CVE Published

via MITRE·07:54 PM

Data Sourced

via MITRE·07:54 PM

DescriptionSeverity

Frequently Asked Questions

What is the vulnerability ID?

The vulnerability ID is CVE-2023-21896.

What component of Oracle Systems is affected?

The NSSwitch component of Oracle Solaris is affected.

Which versions of Oracle Solaris are affected?

Versions 10 and 11 of Oracle Solaris are affected.

What is the severity of the vulnerability?

The vulnerability has a severity level of high.

How can the vulnerability be exploited?

A low privileged attacker with logon access to the Oracle Solaris infrastructure can exploit the vulnerability.

How can the vulnerability be fixed?

Updating to the latest version of Oracle Solaris is recommended to fix the vulnerability.

Where can I find more information about the vulnerability?

You can find more information about the vulnerability at the following link: [Oracle Security Alerts](https://www.oracle.com/security-alerts/cpuapr2023.html).