CVE-2021-21290: netty before 4.1.59 (exclusive), < 4.1.59.Final; +12 more affected products

Affected technology

netty · before 4.1.59 (exclusive)
netty

debian linux · 9.0
debian

debian linux · 10.0
debian

quarkus · through 1.13.7 (inclusive)
quarkus

banking corporate lending process management · 14.2.0
oracle

banking corporate lending process management · 14.3.0
oracle

banking corporate lending process management · 14.5.0
oracle

banking credit facilities process management · 14.2.0
oracle

banking credit facilities process management · 14.3.0
oracle

banking credit facilities process management · 14.5.0
oracle

banking trade finance process management · 14.2.0
oracle

banking trade finance process management · 14.3.0
oracle

banking trade finance process management · 14.5.0
oracle

communications brm - elastic charging engine · 12.0.0.3
oracle

communications design studio · 7.4.2
oracle

communications messaging server · 8.1
oracle

nosql database · before 20.3 (exclusive)
oracle

active iq unified manager · Version not applicable in the source CPE
netapp

cloud secure agent · Version not applicable in the source CPE
netapp

snapcenter · Version not applicable in the source CPE
netapp

netty · < 4.1.59.Final
netty

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Local · No privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

The source reports that an attacker could access information they should not be able to access under the conditions described by the source. Vendor/CNA’s CVSS 3.1 assessment (base score 6.2/10) rates confidentiality impact as high; integrity and availability impact as none. NVD’s CVSS 3.1 assessment (base score 5.5/10) rates confidentiality impact as high; integrity and availability impact as none.