CVE-2021-2328: 
NixOS vulnerability analysis and mitigation

Vulnerability CVE-2021-2328 affects the Oracle Text component of Oracle Database Server versions 12.1.0.2, 12.2.0.1, and 19c. The vulnerability was disclosed in July 2021 as part of Oracle's Critical Patch Update (Oracle Advisory).

This is an easily exploitable vulnerability that allows high privileged attackers with Create Any Procedure and Alter Any Table privileges and network access via Oracle Net to compromise Oracle Text. The vulnerability has a CVSS v3.1 Base Score of 7.2 (High) with the following vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (Oracle Advisory).

Successful exploitation of this vulnerability can result in complete takeover of the Oracle Text component, potentially affecting the confidentiality, integrity, and availability of the system (Oracle Advisory).

The vulnerability requires high privileges (Create Any Procedure, Alter Any Table) and network access via Oracle Net for exploitation. The attack complexity is rated as Low, requiring no user interaction for successful exploitation (Oracle Advisory).

Oracle has released security patches to address this vulnerability as part of the July 2021 Critical Patch Update. Users should update to the latest patched versions of the affected Oracle Database Server versions (12.1.0.2, 12.2.0.1, and 19c) (Oracle Advisory).