Vulnerability in the Java SE product of Oracle Java SE (component: JNDI).

published 2021-07-20 5 y ago modified 2026-09-08 2 mo ago also BIT-java-2021-2432 , BIT-java-min-2021-2432 , BIT-jre-2021-2432 , EUVD-2021-16891

cvss: 3.7; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 3.7%; EPSS 3.7% chance of exploitation in 30 days, percentile 89%
public exploits: 0; none known

Vulnerability in the Java SE product of Oracle Java SE (component: JNDI). The supported version that is affected is Java SE: 7u301. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

Patch / fix

fixed in 12 distros 3 links 1

bitnami java 1.7.0, 7.0.311
bitnami java-min 1.7.0, 7.0.311
bitnami jre 1.7.0, 7.0.311
oracle java_se 1.7.0_311, 7.0.311
oracle jdk 1.7.0_311, 7.0.311
oracle jre 1.7.0_311, 7.0.311
sun java 1.7.0_311, 7.0.311
sun java_se 1.7.0_311, 7.0.311
sun jdk 1.7.0_311, 7.0.311
sun jre 1.7.0_311, 7.0.311
oracle openjdk 1.7.0_311, 7.0.311
sun openjdk 1.7.0_311, 7.0.311

red hat suse alpine

java-1.7.1-ibm RHEL 7 EXTRAS 1:1.7.1.4.90-1jpp.1.el7
java-1.7.1-ibm-src RHEL 7 EXTRAS 1:1.7.1.4.90-1jpp.1.el7
java-1.7.1-ibm-demo RHEL 7 EXTRAS 1:1.7.1.4.90-1jpp.1.el7
java-1.7.1-ibm-jdbc RHEL 7 EXTRAS 1:1.7.1.4.90-1jpp.1.el7
java-1.7.1-ibm-plugin RHEL 7 EXTRAS 1:1.7.1.4.90-1jpp.1.el7

red hat advisories RHSA-2021:3293

java-1_7_1-ibm SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES for SAP 12 SP3 +11 more 1.7.1_sr5.0-38.65.1
java-1_7_0-ibm SLE Point of Sale 11 SP3 1.7.0_sr11.0-65.63.1
java-1_7_0-openjdk SLES for SAP 12 SP5, SLES 12 SP5 1.7.0.311-43.50.2
java-1_7_1-ibm SLES 11 SP4-LTSS 1.7.1_sr5.0-26.68.1

suse advisories SUSE-SU-2022:0166-1 SUSE-SU-2022:14876-1 SUSE-SU-2022:14875-1 SUSE-SU-2021:3007-1

openjdk7 Alpine 3.18, Alpine 3.17, Alpine 3.16 +1 more 7.311.2.6.27-r0

alpine advisories ALPINE-CVE-2021-2432

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

oracle.com/security-alerts/cpuoct2021.html advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-2432 updated 2026-06-28 cvss 3.7

JDK: unspecified vulnerability fixed in 7u311 (JNDI)

Red Hat Enterprise Linux Client Supplementary (v. 7) java-1.7.1-ibm 1.7.1.4.90-1jpp.1.el7, java-1.7.1-ibm-src 1.7.1.4.90-1jpp.1.el7, java-1.7.1-ibm-demo 1.7.1.4.90-1jpp.1.el7, java-1.7.1-ibm-jdbc 1.7.1.4.90-1jpp.1.el7, java-1.7.1-ibm-plugin 1.7.1.4.90-1jpp.1.el7 Red Hat Enterprise Linux ComputeNode Supplementary (v. 7) java-1.7.1-ibm 1.7.1.4.90-1jpp.1.el7, java-1.7.1-ibm-src 1.7.1.4.90-1jpp.1.el7, java-1.7.1-ibm-demo 1.7.1.4.90-1jpp.1.el7 Red Hat Enterprise Linux Server Supplementary (v. 7) java-1.7.1-ibm 1.7.1.4.90-1jpp.1.el7, java-1.7.1-ibm-src 1.7.1.4.90-1jpp.1.el7, java-1.7.1-ibm-demo 1.7.1.4.90-1jpp.1.el7, java-1.7.1-ibm-jdbc 1.7.1.4.90-1jpp.1.el7, java-1.7.1-ibm-plugin 1.7.1.4.90-1jpp.1.el7 Red Hat Enterprise Linux Workstation Supplementary (v. 7) java-1.7.1-ibm 1.7.1.4.90-1jpp.1.el7, java-1.7.1-ibm-src 1.7.1.4.90-1jpp.1.el7, java-1.7.1-ibm-demo 1.7.1.4.90-1jpp.1.el7, java-1.7.1-ibm-jdbc 1.7.1.4.90-1jpp.1.el7, java-1.7.1-ibm-plugin 1.7.1.4.90-1jpp.1.el7
fixed: vendor fix RHSA-2021:3293

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-09-25)

Exploit prediction

3.70% chance of exploitation in the next 30 days, higher than 89% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	3.7	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD	2.0	4.3	AV:N/AC:M/Au:N/C:N/I:N/A:P
OSV	3.1	3.7	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected packages

ecosystem	package	affected	fixed in
bitnami	java	<1.7.0 >=7.0.0, <7.0.311	1.7.0 7.0.311
bitnami	java-min	<1.7.0 >=7.0.0, <7.0.311	1.7.0 7.0.311
bitnami	jre	<1.7.0 >=7.0.0, <7.0.311	1.7.0 7.0.311

Affected products

Oracle Corporation Java SE JDK and JRE

References

oracle.com /security-alerts/cpuoct2021.html
patch, vendor-advisory, advisory
security.gentoo.org /glsa/202209-05
vendor-advisory, third-party-advisory, advisory
oracle.com /security-alerts/cpujul2021.html
vendor-advisory, advisory
security.netapp.com /advisory/ntap-20210723-0002/
third-party-advisory, advisory
kc.mcafee.com /corporate/index?page=content&id=SB10366
third-party-advisory, advisory
nvd.nist.gov /vuln/detail/CVE-2021-2432
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Updated Java versions.

Summary