CVE catalog

CVE-2021-35567

openjdk-17: CVE-2021-35567

[CVE catalog]

Severity
Medium · CVSS 6.8CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
2.90% · Oct 25, 2026

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via Kerberos to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 6.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N).

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianopenjdk-17sid17.0.21+9-1fixed
Debianopenjdk-17bookworm17.0.19+10-1~deb12u2fixed
Debianopenjdk-17bookworm-security17.0.21+9-1~deb12u1fixed
Ubuntuopenjdk-8pro8u66-b01-5vulnerable
Ubuntuopenjdk-8pro8u72-b05-1ubuntu1vulnerable
Ubuntuopenjdk-8pro8u72-b05-5vulnerable
Ubuntuopenjdk-8pro8u72-b05-6vulnerable
Ubuntuopenjdk-8pro8u72-b15-1vulnerable
Ubuntuopenjdk-8pro8u72-b15-2ubuntu1vulnerable
Ubuntuopenjdk-8pro8u72-b15-2ubuntu3vulnerable
Ubuntuopenjdk-8pro8u72-b15-3ubuntu1vulnerable
Ubuntuopenjdk-8pro8u77-b03-1ubuntu2vulnerable
Ubuntuopenjdk-8pro8u77-b03-3ubuntu1vulnerable
Ubuntuopenjdk-8pro8u77-b03-3ubuntu2vulnerable
Ubuntuopenjdk-8pro8u77-b03-3ubuntu3vulnerable
Ubuntuopenjdk-8pro8u91-b14-0ubuntu4~16.04.1vulnerable
Ubuntuopenjdk-8pro8u91-b14-3ubuntu1~16.04.1vulnerable
Ubuntuopenjdk-8pro8u111-b14-2ubuntu0.16.04.2vulnerable
Ubuntuopenjdk-8pro8u121-b13-0ubuntu1.16.04.2vulnerable
Ubuntuopenjdk-8pro8u131-b11-0ubuntu1.16.04.2vulnerable
Ubuntuopenjdk-8pro8u131-b11-2ubuntu1.16.04.2vulnerable
Ubuntuopenjdk-8pro8u131-b11-2ubuntu1.16.04.3vulnerable
Ubuntuopenjdk-8pro8u151-b12-0ubuntu0.16.04.2vulnerable
Ubuntuopenjdk-8pro8u162-b12-0ubuntu0.16.04.2vulnerable
Ubuntuopenjdk-8pro8u171-b11-0ubuntu0.16.04.1vulnerable
Ubuntuopenjdk-8pro8u181-b13-0ubuntu0.16.04.1vulnerable
Ubuntuopenjdk-8pro8u181-b13-1ubuntu0.16.04.1vulnerable
Ubuntuopenjdk-8pro8u191-b12-0ubuntu0.16.04.1vulnerable
Ubuntuopenjdk-8pro8u191-b12-2ubuntu0.16.04.1vulnerable
Ubuntuopenjdk-8pro8u212-b03-0ubuntu1.16.04.1vulnerable
Ubuntuopenjdk-8pro8u222-b10-1ubuntu1~16.04.1vulnerable
Ubuntuopenjdk-8pro8u232-b09-0ubuntu1~16.04.1vulnerable
Ubuntuopenjdk-8pro8u242-b08-0ubuntu3~16.04vulnerable
Ubuntuopenjdk-8pro8u252-b09-1~16.04vulnerable
Ubuntuopenjdk-8pro8u265-b01-0ubuntu2~16.04vulnerable
Ubuntuopenjdk-8pro8u272-b10-0ubuntu1~16.04vulnerable
Ubuntuopenjdk-8pro8u275-b01-0ubuntu1~16.04vulnerable
Ubuntuopenjdk-8pro8u282-b08-0ubuntu1~16.04vulnerable
Ubuntuopenjdk-8pro8u292-b10-0ubuntu1~16.04.1vulnerable
Ubuntuopenjdk-8pro8u312-b07-0ubuntu1~16.04fixed
Ubuntuopenjdk-916.049~b88-1vulnerable
Ubuntuopenjdk-916.049~b101-2ubuntu2vulnerable
Ubuntuopenjdk-916.049~b102-1vulnerable
Ubuntuopenjdk-916.049~b113-0ubuntu1vulnerable
Ubuntuopenjdk-916.049~b114-0ubuntu1vulnerable
Ubuntuopenjdk-818.048u144-b01-2vulnerable
Ubuntuopenjdk-818.048u151-b12-1vulnerable
Ubuntuopenjdk-818.048u162-b12-1vulnerable
Ubuntuopenjdk-818.048u171-b11-0ubuntu0.18.04.1vulnerable
Ubuntuopenjdk-818.048u181-b13-0ubuntu0.18.04.1vulnerable
Ubuntuopenjdk-818.048u181-b13-1ubuntu0.18.04.1vulnerable
Ubuntuopenjdk-818.048u191-b12-0ubuntu0.18.04.1vulnerable
Ubuntuopenjdk-818.048u191-b12-2ubuntu0.18.04.1vulnerable
Ubuntuopenjdk-818.048u212-b03-0ubuntu1.18.04.1vulnerable
Ubuntuopenjdk-818.048u222-b10-1ubuntu1~18.04.1vulnerable
Ubuntuopenjdk-818.048u232-b09-0ubuntu1~18.04.1vulnerable
Ubuntuopenjdk-818.048u242-b08-0ubuntu3~18.04vulnerable
Ubuntuopenjdk-818.048u252-b09-1~18.04vulnerable
Ubuntuopenjdk-818.048u265-b01-0ubuntu2~18.04vulnerable
Ubuntuopenjdk-818.048u272-b10-0ubuntu1~18.04vulnerable
Ubuntuopenjdk-818.048u275-b01-0ubuntu1~18.04vulnerable
Ubuntuopenjdk-818.048u282-b08-0ubuntu1~18.04vulnerable
Ubuntuopenjdk-818.048u292-b10-0ubuntu1~18.04vulnerable
Ubuntuopenjdk-818.048u312-b07-0ubuntu1~18.04fixed
Ubuntuopenjdk-lts18.049.0.4+12-2ubuntu4vulnerable
Ubuntuopenjdk-lts18.049.0.4+12-4ubuntu1vulnerable
Ubuntuopenjdk-lts18.0410~46-4ubuntu1vulnerable
Ubuntuopenjdk-lts18.0410~46-5ubuntu1vulnerable
Ubuntuopenjdk-lts18.0410.0.1+10-1ubuntu2vulnerable
Ubuntuopenjdk-lts18.0410.0.1+10-3ubuntu1vulnerable
Ubuntuopenjdk-lts18.0410.0.2+13-1ubuntu0.18.04.1vulnerable
Ubuntuopenjdk-lts18.0410.0.2+13-1ubuntu0.18.04.2vulnerable
Ubuntuopenjdk-lts18.0410.0.2+13-1ubuntu0.18.04.3vulnerable
Ubuntuopenjdk-lts18.0410.0.2+13-1ubuntu0.18.04.4vulnerable
Ubuntuopenjdk-lts18.0411.0.2+9-3ubuntu1~18.04.3vulnerable
Ubuntuopenjdk-lts18.0411.0.3+7-1ubuntu2~18.04.1vulnerable
Ubuntuopenjdk-lts18.0411.0.4+11-1ubuntu2~18.04.3vulnerable
Ubuntuopenjdk-lts18.0411.0.5+10-0ubuntu1.1~18.04vulnerable
Ubuntuopenjdk-lts18.0411.0.6+10-1ubuntu1~18.04.1vulnerable
Ubuntuopenjdk-lts18.0411.0.7+10-2ubuntu2~18.04vulnerable
Ubuntuopenjdk-lts18.0411.0.8+10-0ubuntu1~18.04.1vulnerable
Ubuntuopenjdk-lts18.0411.0.9+11-0ubuntu1~18.04.1vulnerable
Ubuntuopenjdk-lts18.0411.0.9.1+1-0ubuntu1~18.04vulnerable
Ubuntuopenjdk-lts18.0411.0.10+9-0ubuntu1~18.04vulnerable
Ubuntuopenjdk-lts18.0411.0.11+9-0ubuntu2~18.04vulnerable
Ubuntuopenjdk-lts18.0411.0.13+8-0ubuntu1~18.04fixed
Ubuntuopenjdk-820.048u232-b09-0ubuntu1vulnerable
Ubuntuopenjdk-820.048u232-b09-1vulnerable
Ubuntuopenjdk-820.048u242-b04-1vulnerable
Ubuntuopenjdk-820.048u242-b08-0ubuntu3vulnerable
Ubuntuopenjdk-820.048u252-b07-1vulnerable
Ubuntuopenjdk-820.048u252-b09-1ubuntu1vulnerable
Ubuntuopenjdk-820.048u265-b01-0ubuntu2~20.04vulnerable
Ubuntuopenjdk-820.048u272-b10-0ubuntu1~20.04vulnerable
Ubuntuopenjdk-820.048u275-b01-0ubuntu1~20.04vulnerable
Ubuntuopenjdk-820.048u282-b08-0ubuntu1~20.04vulnerable
Ubuntuopenjdk-820.048u292-b10-0ubuntu1~20.04vulnerable
Ubuntuopenjdk-820.048u312-b07-0ubuntu1~20.04fixed
Ubuntuopenjdk-lts20.0411.0.5+10-0ubuntu1vulnerable
Ubuntuopenjdk-lts20.0411.0.5+10-2ubuntu1vulnerable
Ubuntuopenjdk-lts20.0411.0.6+10-1ubuntu1vulnerable
Ubuntuopenjdk-lts20.0411.0.6+10-2ubuntu2vulnerable
Ubuntuopenjdk-lts20.0411.0.7+9-1ubuntu1vulnerable
Ubuntuopenjdk-lts20.0411.0.7+10-2ubuntu1vulnerable
Ubuntuopenjdk-lts20.0411.0.7+10-3ubuntu1vulnerable
Ubuntuopenjdk-lts20.0411.0.8+10-0ubuntu1~20.04vulnerable
Ubuntuopenjdk-lts20.0411.0.9+11-0ubuntu1~20.04vulnerable
Ubuntuopenjdk-lts20.0411.0.9.1+1-0ubuntu1~20.04vulnerable
Ubuntuopenjdk-lts20.0411.0.10+9-0ubuntu1~20.04vulnerable
Ubuntuopenjdk-lts20.0411.0.11+9-0ubuntu2~20.04vulnerable
Ubuntuopenjdk-lts20.0411.0.13+8-0ubuntu1~20.04fixed
Ubuntuopenjdk-1320.0413+33-1vulnerable
Ubuntuopenjdk-1320.0413.0.1+9-2vulnerable
Ubuntuopenjdk-1320.0413.0.2+8-1vulnerable
Ubuntuopenjdk-1320.0413.0.2+8-2vulnerable
Ubuntuopenjdk-1320.0413.0.3+3-1ubuntu2vulnerable
Ubuntuopenjdk-1320.0413.0.4+8-1~20.04vulnerable
Ubuntuopenjdk-1320.0413.0.7+5-0ubuntu1~20.04vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianopenjdk-17sourcesid17.0.1+12-1not yet assignedNot reportedNot reported
Debianopenjdk-17sourcebookworm17.0.1+12-1not yet assignedNot reportedNot reported
Ubuntuopenjdk-8debpro8u312-b07-0ubuntu1~16.04Not reportedUBUNTU-CVE-2021-35567Not reported
Ubuntuopenjdk-8deb18.048u312-b07-0ubuntu1~18.04Not reportedUBUNTU-CVE-2021-35567Not reported
Ubuntuopenjdk-ltsdeb18.0411.0.13+8-0ubuntu1~18.04Not reportedUBUNTU-CVE-2021-35567Not reported
Ubuntuopenjdk-8deb20.048u312-b07-0ubuntu1~20.04Not reportedUBUNTU-CVE-2021-35567Not reported
Ubuntuopenjdk-ltsdeb20.0411.0.13+8-0ubuntu1~20.04Not reportedUBUNTU-CVE-2021-35567Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • Source package: [openjdk-17]

    Details (4)
    • 17.0.19+10-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 17.0.1+12-1

      dsa · openjdk-17 · debian · bookworm; dsa · openjdk-17 · debian · 12

    • 17.0.19+10-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 17.0.1+12-1

      dsa · openjdk-17 · debian · bookworm; dsa · openjdk-17 · debian · 12

    • 17.0.20.1+1-1~deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 17.0.1+12-1

      dsa · openjdk-17 · debian · bookworm; dsa · openjdk-17 · debian · 12

    • 17.0.20.1+1-1~deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 17.0.1+12-1

      dsa · openjdk-17 · debian · bookworm; dsa · openjdk-17 · debian · 12

  • Source package: [openjdk-17]

    Details (4)
    • 17.0.19+10-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 17.0.1+12-1

      dsa · openjdk-17 · debian · bookworm; dsa · openjdk-17 · debian · 12

    • 17.0.19+10-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 17.0.1+12-1

      dsa · openjdk-17 · debian · bookworm; dsa · openjdk-17 · debian · 12

    • 17.0.20.1+1-1~deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 17.0.1+12-1

      dsa · openjdk-17 · debian · bookworm; dsa · openjdk-17 · debian · 12

    • 17.0.20.1+1-1~deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 17.0.1+12-1

      dsa · openjdk-17 · debian · bookworm; dsa · openjdk-17 · debian · 12

  • Source package: [openjdk-17]

    Details (4)
    • 17.0.19+10-1~deb12u2 · all · bookworm

      Fixed · Fixed: 17.0.1+12-1

      dsa · openjdk-17 · debian · bookworm; dsa · openjdk-17 · debian · 12

    • 17.0.19+10-1~deb12u2 · all · bookworm

      Fixed · Fixed: 17.0.1+12-1

      dsa · openjdk-17 · debian · bookworm; dsa · openjdk-17 · debian · 12

    • 17.0.20.1+1-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 17.0.1+12-1

      dsa · openjdk-17 · debian · bookworm; dsa · openjdk-17 · debian · 12

    • 17.0.20.1+1-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 17.0.1+12-1

      dsa · openjdk-17 · debian · bookworm; dsa · openjdk-17 · debian · 12

  • Source package: [openjdk-17]

    Details (4)
    • 17.0.19+10-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 17.0.1+12-1

      dsa · openjdk-17 · debian · bookworm; dsa · openjdk-17 · debian · 12

    • 17.0.19+10-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 17.0.1+12-1

      dsa · openjdk-17 · debian · bookworm; dsa · openjdk-17 · debian · 12

    • 17.0.20.1+1-1~deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 17.0.1+12-1

      dsa · openjdk-17 · debian · bookworm; dsa · openjdk-17 · debian · 12

    • 17.0.20.1+1-1~deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 17.0.1+12-1

      dsa · openjdk-17 · debian · bookworm; dsa · openjdk-17 · debian · 12

  • Source package: [openjdk-17]

    Details (4)
    • 17.0.19+10-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 17.0.1+12-1

      dsa · openjdk-17 · debian · bookworm; dsa · openjdk-17 · debian · 12

    • 17.0.19+10-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 17.0.1+12-1

      dsa · openjdk-17 · debian · bookworm; dsa · openjdk-17 · debian · 12

    • 17.0.20.1+1-1~deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 17.0.1+12-1

      dsa · openjdk-17 · debian · bookworm; dsa · openjdk-17 · debian · 12

    • 17.0.20.1+1-1~deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 17.0.1+12-1

      dsa · openjdk-17 · debian · bookworm; dsa · openjdk-17 · debian · 12

  • Source package: [openjdk-17]

    Details (4)
    • 17.0.19+10-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 17.0.1+12-1

      dsa · openjdk-17 · debian · bookworm; dsa · openjdk-17 · debian · 12

    • 17.0.19+10-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 17.0.1+12-1

      dsa · openjdk-17 · debian · bookworm; dsa · openjdk-17 · debian · 12

    • 17.0.20.1+1-1~deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 17.0.1+12-1

      dsa · openjdk-17 · debian · bookworm; dsa · openjdk-17 · debian · 12

    • 17.0.20.1+1-1~deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 17.0.1+12-1

      dsa · openjdk-17 · debian · bookworm; dsa · openjdk-17 · debian · 12

  • Source package: [openjdk-17]

    Details (4)
    • 17.0.19+10-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 17.0.1+12-1

      dsa · openjdk-17 · debian · bookworm; dsa · openjdk-17 · debian · 12

    • 17.0.19+10-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 17.0.1+12-1

      dsa · openjdk-17 · debian · bookworm; dsa · openjdk-17 · debian · 12

    • 17.0.20.1+1-1~deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 17.0.1+12-1

      dsa · openjdk-17 · debian · bookworm; dsa · openjdk-17 · debian · 12

    • 17.0.20.1+1-1~deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 17.0.1+12-1

      dsa · openjdk-17 · debian · bookworm; dsa · openjdk-17 · debian · 12

  • Source package: [openjdk-17]

    Details (4)
    • 17.0.19+10-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 17.0.1+12-1

      dsa · openjdk-17 · debian · bookworm; dsa · openjdk-17 · debian · 12

    • 17.0.19+10-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 17.0.1+12-1

      dsa · openjdk-17 · debian · bookworm; dsa · openjdk-17 · debian · 12

    • 17.0.20.1+1-1~deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 17.0.1+12-1

      dsa · openjdk-17 · debian · bookworm; dsa · openjdk-17 · debian · 12

    • 17.0.20.1+1-1~deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 17.0.1+12-1

      dsa · openjdk-17 · debian · bookworm; dsa · openjdk-17 · debian · 12

  • Source package: [openjdk-17]

    Details (4)
    • 17.0.19+10-1~deb12u2 · all · bookworm

      Fixed · Fixed: 17.0.1+12-1

      dsa · openjdk-17 · debian · bookworm; dsa · openjdk-17 · debian · 12

    • 17.0.19+10-1~deb12u2 · all · bookworm

      Fixed · Fixed: 17.0.1+12-1

      dsa · openjdk-17 · debian · bookworm; dsa · openjdk-17 · debian · 12

    • 17.0.20.1+1-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 17.0.1+12-1

      dsa · openjdk-17 · debian · bookworm; dsa · openjdk-17 · debian · 12

    • 17.0.20.1+1-1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 17.0.1+12-1

      dsa · openjdk-17 · debian · bookworm; dsa · openjdk-17 · debian · 12

Observed:

References