CVE-2021-2163: 
NixOS vulnerability analysis and mitigation

CVE-2021-2163 is a vulnerability in Java SE, Java SE Embedded, and Oracle GraalVM Enterprise Edition affecting multiple versions including Java SE (7u291, 8u281, 11.0.10, 16), Java SE Embedded (8u281), and Oracle GraalVM Enterprise Edition (19.3.5, 20.3.1.2, 21.0.0.2). This vulnerability was disclosed in April 2021 and relates to incomplete enforcement of JAR signing disabled algorithms (Oracle CPU, NVD).

The vulnerability is difficult to exploit and requires network access via multiple protocols. It has a CVSS v3.1 Base Score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N. Successful exploitation requires human interaction from a person other than the attacker. The vulnerability specifically applies to Java deployments that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security (NVD).

Successful exploitation of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition accessible data. The vulnerability primarily affects integrity with no direct impact on confidentiality or availability (Oracle CPU).

Oracle released patches for affected versions in their April 2021 Critical Patch Update. Users should upgrade to the fixed versions: Java SE (7u291 or later, 8u281 or later, 11.0.10 or later), Java SE Embedded (8u281 or later), and Oracle GraalVM Enterprise Edition (19.3.5 or later, 20.3.1.2 or later, 21.0.0.2 or later). Multiple Linux distributions including Red Hat, Debian, and Fedora have also released security updates to address this vulnerability (Oracle CPU, Debian Advisory).