CVE-2021-2351
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported...
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Advanced Networking Option, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Advanced Networking Option. Note: The July 2021 Critical Patch Update introduces a number of Native Network Encryption changes to deal with vulnerability CVE-2021-2351 and prevent the use of weaker ciphers. Customers should review: "Changes in Native Network Encryption with the July 2021 Critical Patch Update" (Doc ID 2791571.1). CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Advanced Networking Option, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Advanced Networking Option. Note: The July 2021 Critical Patch Update introduces a number of Native Network Encryption changes to deal with vulnerability CVE-2021-2351 and prevent the use of weaker ciphers. Customers should review: "Changes in Native Network Encryption with the July 2021 Critical Patch Update" (Doc ID 2791571.1). CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).
- Record
CVE-2021-2351- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
EUVDEUVD-2021-16810
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Advanced Networking Option, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Advanced Networking Option. Note: The July 2021 Critical Patch Update introduces a number of Native Network Encryption changes to deal with vulnerability CVE-2021-2351 and prevent the use of weaker ciphers. Customers should review: "Changes in Native Network Encryption with the July 2021 Critical Patch Update" (Doc ID 2791571.1). CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).
- Record
EUVD-2021-16810- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gm3p-p24r-4wxq
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported...
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Advanced Networking Option, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Advanced Networking Option. Note: The July 2021 Critical Patch Update introduces a number of Native Network Encryption changes to deal with vulnerability CVE-2021-2351 and prevent the use of weaker ciphers. Customers should review: "Changes in Native Network Encryption with the July 2021 Critical Patch Update" (Doc ID 2791571.1). CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).
- Record
GHSA-gm3p-p24r-4wxq- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-327
- Updated
- 2026-11-02
NVD
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Advanced Networking Option, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Advanced Networking Option. Note: The July 2021 Critical Patch Update introduces a number of Native Network Encryption changes to deal with vulnerability CVE-2021-2351 and prevent the use of weaker ciphers. Customers should review: "Changes in Native Network Encryption with the July 2021 Critical Patch Update" (Doc ID 2791571.1). CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).
- Record
CVE-2021-2351- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 5.1 Medium
AV:N/AC:H/Au:N/C:P/I:P/A:P - Weakness
- CWE-327, CWE-384
- Updated
- 2026-11-02
Affected products
- oracle advanced networking option
- oracle agile engineering data management
- oracle agile product lifecycle management
- oracle agile product lifecycle management for process
- oracle airlines data model
- oracle application performance management
- oracle application testing suite
- oracle argus analytics
- oracle argus insight
- oracle argus mart
- oracle argus safety
- oracle banking apis
Show 100 moreShow less
- oracle banking digital experience
- oracle banking enterprise default management
- oracle banking platform
- oracle big data spatial and graph
- oracle blockchain platform
- oracle clinical
- oracle commerce platform
- oracle communications application session controller
- oracle communications billing and revenue management
- oracle communications calendar server
- oracle communications contacts server
- oracle communications convergent charging controller
- oracle communications data model
- oracle communications design studio
- oracle communications diameter intelligence hub
- oracle communications ip service activator
- oracle communications metasolv solution
- oracle communications network charging and control
- oracle communications network integrity
- oracle communications pricing design center
- oracle communications services gatekeeper
- oracle communications session report manager
- oracle communications session route manager
- oracle data integrator
- oracle demantra demand management
- oracle documaker
- oracle enterprise data quality
- oracle enterprise manager base platform
- oracle enterprise manager ops center
- oracle financial services analytical applications infrastructure
- oracle financial services behavior detection platform
- oracle financial services enterprise case management
- oracle financial services foreign account tax compliance act management
- oracle financial services model management and governance
- oracle financial services trade-based anti money laundering
- oracle flexcube investor servicing
- oracle flexcube private banking
- oracle fusion middleware
- oracle goldengate
- oracle goldengate application adapters
- oracle graph server and client
- oracle health sciences clinical development analytics
- oracle health sciences inform crf submit
- oracle health sciences information manager
- oracle healthcare data repository
- oracle healthcare foundation
- oracle healthcare translational research
- oracle hospitality inventory management
- oracle hospitality opera 5
- oracle hospitality reporting and analytics
- oracle hospitality suite8
- oracle hyperion infrastructure technology
- oracle ilearning
- oracle instantis enterprisetrack
- oracle insurance data gateway
- oracle insurance insbridge rating and underwriting
- oracle insurance policy administration
- oracle insurance rules palette
- oracle jd edwards enterpriseone tools
- oracle oss support tools
- oracle peoplesoft enterprise peopletools
- oracle policy automation
- oracle primavera analytics
- oracle primavera data warehouse
- oracle primavera gateway
- oracle primavera p6 enterprise project portfolio management
- oracle primavera p6 professional project management
- oracle primavera unifier
- oracle product lifecycle analytics
- oracle rapid planning
- oracle real user experience insight
- oracle retail analytics
- oracle retail assortment planning
- oracle retail back office
- oracle retail central office
- oracle retail customer insights
- oracle retail extract transform and load
- oracle retail financial integration
- oracle retail integration bus
- oracle retail merchandising system
- oracle retail order broker
- oracle retail order management system
- oracle retail point-of-service
- oracle retail predictive application server
- oracle retail price management
- oracle retail returns management
- oracle retail service backbone
- oracle retail store inventory management
- oracle retail xstore point of service
- oracle siebel ui framework
- oracle spatial studio
- oracle storagetek acsls
- oracle storagetek tape analytics
- oracle thesaurus management system
- oracle timesten in-memory database
- oracle utilities framework
- oracle utilities testing accelerator
- oracle weblogic server
- oracle zfs storage application integration engineering software
- oracle corporation weblogic server
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-2351 is a high vulnerability (CVSS 8.3) in Oracle Advanced Networking Option, published July 20, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.43%, the 84th percentile. No source names a fixed version.
References
oracle.com/security-alerts/cpujul2021.html
seclists.org/fulldisclosure/2021/Dec/19
packetstormsecurity.com/files/165258/Oracle-Database-Weak-NNE-Integrity-Key-Derivation.html