Improper input validation in Oracle GraalVM Enterprise Edition - CVE-2021-29921

Vulnerability identifier: #VU55056

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-29921

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Python interpreter and runtime (CPython) component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

Oracle GraalVM Enterprise Edition
Solutions Enabler Virtual Appliance
Gentoo Linux
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Anolis OS
Ubuntu
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Module for Development Tools
Oracle Communications Cloud Native Core Automated Test Suite
Oracle Communications Cloud Native Core Binding Support Function
Dell EMC Data Protection Search
Oracle Communications Cloud Native Core Network Slice Selection Function
python3.11 (Ubuntu package)
python3.5-minimal (Ubuntu package)
python3.5 (Ubuntu package)
python3.11-minimal (Ubuntu package)
python3.7-minimal (Ubuntu package)
python3.7 (Ubuntu package)
python3.6-minimal (Ubuntu package)
python3.6 (Ubuntu package)
python3.9-minimal (Ubuntu package)
python3.9 (Ubuntu package)
python3.8-minimal (Ubuntu package)
python3.8 (Ubuntu package)
python38-wcwidth
python39-wcwidth
python38-PyMySQL
python39-PyMySQL
python39-toml
python38-pluggy
python39-pluggy
python38-Cython
python39-Cython
python38-wheel
python38-wheel-wheel
python39-wheel-wheel
python39-wheel
python39-iniconfig
python38-markupsafe
python38-asn1crypto
python38-atomicwrites
python38-scipy
python39-scipy
python39-pysocks
python38-pysocks
python38-py
python39-py
python38-six
python38-cffi
python39-cffi
python39-six
python38-numpy
python38-numpy-f2py
python38-numpy-doc
python39-numpy-doc
python39-numpy-f2py
python39-numpy
python38-urllib3
python39-urllib3
python38-pyparsing
python39-pyparsing
python38-babel
python39-pybind11-devel
python39-pybind11
python38-cryptography
python38-psycopg2
python38-psycopg2-doc
python38-psycopg2-tests
python38-idna
python39-psycopg2-tests
python39-psycopg2-doc
python39-psycopg2
python39-idna
python38-jinja2
python38-pycparser
python39-pycparser
python38-requests
python39-requests
python38-chardet
python39-chardet
python39-cryptography
python38-test
python38-tkinter
python38-rpm-macros
python38-libs
python38-idle
python38-devel
python38-debug
python38
python39-tools
python39-base-debuginfo
python39-core-debugsource
python39-devel
libpython3_9-1_0
libpython3_9-1_0-debuginfo
python39-base
python39
python39-curses
python39-curses-debuginfo
python39-dbm
python39-dbm-debuginfo
python39-tk-debuginfo
python39-tk
python39-idle
python39-debuginfo
python39-debugsource
python39-libs
python39-tkinter
python39-test
python39-rpm-macros
python39-debug
python3.10-minimal (Ubuntu package)
python3.10 (Ubuntu package)
python39-ply
python38-ply
python3.12 (Ubuntu package)
python3.12-minimal (Ubuntu package)
python38-lxml
python39-lxml
python38-pytest
python38-mod_wsgi
python39-mod_wsgi
python39-pyyaml
python38-pyyaml
python38-psutil
python39-psutil
python39-pytest
python38-more-itertools
python39-more-itertools
python38-packaging
python38-attrs
python38-pip
python38-pip-wheel
python39-pip
python39-pip-wheel
python39-attrs
python39-packaging
python38-setuptools-wheel
python38-setuptools
python39-setuptools-wheel
python39-setuptools
python38-pytz
IBM Cloud Private
OpenManage Network Integration (OMNI)
Solutions Enabler
Unisphere for PowerMax Virtual Appliance
Unisphere for PowerMax
Dell EMC PowerProtect Data Protection
Dell Enterprise SONiC Distribution

Install updates from vendor's website.

python3.11 (Ubuntu package) - addressed in versions Ubuntu Pro, 3.11.6-3ubuntu0.1
python3.5-minimal (Ubuntu package) - update to Ubuntu Pro
python3.5 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
python3.11-minimal (Ubuntu package) - addressed in versions Ubuntu Pro, 3.11.6-3ubuntu0.1
python3.7-minimal (Ubuntu package) - update to Ubuntu Pro
python3.7 (Ubuntu package) - update to Ubuntu Pro
python3.6-minimal (Ubuntu package) - update to Ubuntu Pro
python3.6 (Ubuntu package) - update to Ubuntu Pro
python3.9-minimal (Ubuntu package) - update to Ubuntu Pro
python3.9 (Ubuntu package) - update to Ubuntu Pro
python3.8-minimal (Ubuntu package) - addressed in versions Ubuntu Pro, 3.8.5-1~20.04.3, 3.8.6-1ubuntu0.3, 3.8.10-0ubuntu1~20.04.1, 3.8.10-0ubuntu1~20.04.10
python3.8 (Ubuntu package) - addressed in versions Ubuntu Pro, 3.8.5-1~20.04.3, 3.8.6-1ubuntu0.3, 3.8.10-0ubuntu1~20.04.1, 3.8.10-0ubuntu1~20.04.10
python38-wcwidth - update to 0.1.7-16
python39-wcwidth - update to 0.2.5-3
python38-PyMySQL - update to 0.10.1-1
python39-PyMySQL - update to 0.10.1-2
python39-toml - update to 0.10.1-5
python38-pluggy - update to 0.13.0-3
python39-pluggy - update to 0.13.1-3
python38-Cython - update to 0.29.14-4
python39-Cython - update to 0.29.21-5
python38-wheel - update to 0.33.6-6
python38-wheel-wheel - update to 0.33.6-6
python39-wheel-wheel - update to 0.35.1-4
python39-wheel - update to 0.35.1-4
python39-iniconfig - update to 1.1.1-2
python38-markupsafe - update to 1.1.1-6
python38-asn1crypto - update to 1.2.0-3
python38-atomicwrites - update to 1.3.0-8
python38-scipy - update to 1.3.1-4
python39-scipy - update to 1.5.4-3
python39-pysocks - update to 1.7.1-4
python38-pysocks - update to 1.7.1-4
python38-py - update to 1.8.0-8
python39-py - update to 1.10.0-1
python38-six - update to 1.12.0-10
python38-cffi - update to 1.13.2-3
python39-cffi - update to 1.14.3-2
python39-six - update to 1.15.0-3
python38-numpy - update to 1.17.3-6
python38-numpy-f2py - update to 1.17.3-6
python38-numpy-doc - update to 1.17.3-6
python39-numpy-doc - update to 1.19.4-3
python39-numpy-f2py - update to 1.19.4-3
python39-numpy - update to 1.19.4-3
python38-urllib3 - update to 1.25.7-5
python39-urllib3 - update to 1.25.10-4
python38-pyparsing - update to 2.4.5-3
python39-pyparsing - update to 2.4.7-5
python38-babel - update to 2.7.0-11
python39-pybind11-devel - update to 2.7.1-1
python39-pybind11 - update to 2.7.1-1
python38-cryptography - update to 2.8-3
python38-psycopg2 - update to 2.8.4-4
python38-psycopg2-doc - update to 2.8.4-4
python38-psycopg2-tests - update to 2.8.4-4
python38-idna - update to 2.8-6
python39-psycopg2-tests - update to 2.8.6-2.0.1
python39-psycopg2-doc - update to 2.8.6-2.0.1
python39-psycopg2 - update to 2.8.6-2.0.1
python39-idna - update to 2.10-3
python38-jinja2 - update to 2.10.3-5
python38-pycparser - update to 2.19-3
python39-pycparser - update to 2.20-3
python38-requests - update to 2.22.0-9
python39-requests - update to 2.25.0-2
python38-chardet - update to 3.0.4-19
python39-chardet - update to 3.0.4-19
IBM Cloud Private - addressed in versions 3.2.1.2203, 3.2.2.2203
python39-cryptography - update to 3.3.1-2
OpenManage Network Integration (OMNI) - update to 3.7
python38-test - update to 3.8.12-1.0.1
python38-tkinter - update to 3.8.12-1.0.1
python38-rpm-macros - update to 3.8.12-1.0.1
python38-libs - update to 3.8.12-1.0.1
python38-idle - update to 3.8.12-1.0.1
python38-devel - update to 3.8.12-1.0.1
python38-debug - update to 3.8.12-1.0.1
python38 - update to 3.8.12-1.0.1
python39-tools - update to 3.9.6-4.3.3
python39-base-debuginfo - update to 3.9.6-4.3.3
python39-core-debugsource - update to 3.9.6-4.3.3
python39-devel - update to 3.9.6-4.3.3
libpython3_9-1_0 - update to 3.9.6-4.3.3
libpython3_9-1_0-debuginfo - update to 3.9.6-4.3.3
python39-base - update to 3.9.6-4.3.3
python39 - update to 3.9.6-4.3.4
python39-curses - update to 3.9.6-4.3.4
python39-curses-debuginfo - update to 3.9.6-4.3.4
python39-dbm - update to 3.9.6-4.3.4
python39-dbm-debuginfo - update to 3.9.6-4.3.4
python39-tk-debuginfo - update to 3.9.6-4.3.4
python39-tk - update to 3.9.6-4.3.4
python39-idle - update to 3.9.6-4.3.4
python39-debuginfo - update to 3.9.6-4.3.4
python39-debugsource - update to 3.9.6-4.3.4
python39-libs - update to 3.9.7-1.0.1
python39-tkinter - update to 3.9.7-1.0.1
python39-test - update to 3.9.7-1.0.1
python39-rpm-macros - update to 3.9.7-1.0.1
python39-idle - update to 3.9.7-1.0.1
python39-devel - update to 3.9.7-1.0.1
python39-debug - update to 3.9.7-1.0.1
python39 - update to 3.9.7-1.0.1
python3.10-minimal (Ubuntu package) - update to 3.10.12-1~22.04.4
python3.10 (Ubuntu package) - update to 3.10.12-1~22.04.4
python39-ply - update to 3.11-10
python38-ply - update to 3.11-10
python3.12 (Ubuntu package) - update to 3.12.0-1ubuntu0.1
python3.12-minimal (Ubuntu package) - update to 3.12.0-1ubuntu0.1
python38-lxml - update to 4.4.1-7
Dell Enterprise SONiC Distribution - update to 4.4.2
python39-lxml - update to 4.6.5-1
python38-pytest - update to 4.6.6-3
python38-mod_wsgi - update to 4.6.8-3
python39-mod_wsgi - update to 4.7.1-4
python39-pyyaml - update to 5.4.1-1
python38-pyyaml - update to 5.4.1-1
python38-psutil - update to 5.6.4-4
python39-psutil - update to 5.8.0-4.0.1
python39-pytest - update to 6.0.2-2
python38-more-itertools - update to 7.2.0-5
python39-more-itertools - update to 8.5.0-2
Solutions Enabler Virtual Appliance - addressed in versions 9.1.0.17, 9.2.2.0
Solutions Enabler - addressed in versions 9.1.0.17, 9.2.2.0
Unisphere for PowerMax Virtual Appliance - addressed in versions 9.1.0.28, 9.2.2.2
Unisphere for PowerMax - addressed in versions 9.1.0.28, 9.2.2.2
python38-packaging - update to 19.2-3
python38-attrs - update to 19.3.0-3
python38-pip - update to 19.3.1-5
python38-pip-wheel - update to 19.3.1-5
Dell EMC PowerProtect Data Protection - update to 19.5.1
Dell EMC Data Protection Search - update to 19.5.1
python39-pip - update to 20.2.4-7
python39-pip-wheel - update to 20.2.4-7
python39-attrs - update to 20.3.0-2
python39-packaging - update to 20.4-4
python38-setuptools-wheel - update to 41.6.0-5
python38-setuptools - update to 41.6.0-5
python39-setuptools-wheel - update to 50.3.2-4
python39-setuptools - update to 50.3.2-4
python38-pytz - update to 2019.3-3

• https://www.oracle.com/security-alerts/cpujul2021.html

• Multiple vulnerabilities in Oracle GraalVM Enterprise Edition
• Improper input validation in Oracle Communications Cloud Native Core Automated Test Suite
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Binding Support Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Slice Selection Function
• SUSE update for python39
• Ubuntu update for python3.8
• Ubuntu update for python3.8
• Multiple vulnerabilities in Dell EMC Data Protection Search and Dell EMC PowerProtect Data Protection
• Multiple vulnerabilities in Dell EMC Unisphere for PowerMax and Dell EMC Solutions Enabler
• Gentoo update for Python, PyPy3
• Ubuntu update for python3.10
• Red Hat Enterprise Linux 8 update for the python39:3.9 and python39-devel:3.9 modules
• Red Hat Enterprise Linux 8 update for the python38:3.8 and python38-devel:3.8 modules
• Multiple vulnerabilities in Dell OpenManage Network Integration (OMNI)
• IBM Cloud Private update for Python
• Anolis OS update for python38:3.8 module
• Anolis OS update for python39:3.9 module
• Multiple vulnerabilities in Dell Enterprise SONiC Distribution