Oracle GraalVM Enterprise Edition 19.3.5/20.3.1.2/21.0.0.2 Node denial of service

Summaryinfo

A vulnerability was found in Oracle GraalVM Enterprise Edition 19.3.5/20.3.1.2/21.0.0.2 and classified as critical. Affected by this issue is some unknown functionality of the component Node. Executing a manipulation can lead to denial of service. This vulnerability appears as CVE-2021-23841. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in Oracle GraalVM Enterprise Edition 19.3.5/20.3.1.2/21.0.0.2. This vulnerability affects an unknown code of the component Node. The manipulation with an unknown input leads to a denial of service vulnerability. The CWE definition for the vulnerability is CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. As an impact it is known to affect availability.

The weakness was presented 04/21/2021 as Oracle Critical Patch Update Advisory - April 2021. The advisory is shared for download at oracle.com. This vulnerability was named CVE-2021-23841. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1499.

The vulnerability scanner Nessus provides a plugin with the ID 211827 (Oracle Linux 9 : edk2 (ELSA-2024-12842)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the databases at Tenable (211827) and CERT Bund (WID-SEC-2022-0669). Once again VulDB remains the best source for vulnerability data.

Affected

• Open Source CentOS
• Open Source OpenSSL
• Debian Linux
• Amazon Linux 2
• FreeBSD Project FreeBSD OS
• Juniper JUNOS
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• Hitachi Command Suite
• Gentoo Linux
• Open Source Arch Linux
• Avaya Aura Communication Manager
• Avaya Aura Session Manager
• Avaya Aura Application Enablement Services
• Avaya Aura System Manager
• Avaya Web License Manager
• Pulse Secure Pulse Connect Secure
• HCL BigFix
• Hitachi Ops Center
• Open Source Node.js
• Meinberg LANTIME
• Tenable Security Nessus
• Netscout Arbor AED
• Netscout Arbor APS
• Netscout Arbor Sightline
• Netscout Arbor TMS
• Tenable Security Nessus Network Monitor
• HPE Fabric OS
• Hitachi Configuration Manager
• F5 BIG-IP
• Trellix ePolicy Orchestrator
• IBM Rational Build Forge
• Dell NetWorker
• SolarWinds Platform
• F5 F5OS

Productinfo

Vendor

• Oracle

Name

• GraalVM Enterprise Edition

Version

• 19.3.5
• 20.3.1.2
• 21.0.0.2

License

• commercial

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion