CVE-2021-2341: 
NixOS vulnerability analysis and mitigation

CVE-2021-2341 is a vulnerability in Java SE and Oracle GraalVM Enterprise Edition's networking component, discovered and reported by Varnavas Papaioannou. The vulnerability affects Java SE versions 7u301, 8u291, 11.0.11, 16.0.1 and Oracle GraalVM Enterprise Edition versions 20.3.2 and 21.1.0. It was disclosed in July 2021 and involves the FTP PASV command response potentially causing FtpClient to connect to arbitrary hosts (Oracle CPUJul2021).

The vulnerability is related to the networking component of Java SE, specifically in how the FTP PASV command response is handled. It has a CVSS 3.1 Base Score of 3.1 (Low severity) with the vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N. This indicates it requires network access, has high attack complexity, needs user interaction, and can potentially impact confidentiality (NVD).

Successful exploitation of this vulnerability can result in unauthorized read access to a subset of Java SE and Oracle GraalVM Enterprise Edition accessible data. The vulnerability specifically applies to Java deployments that load and run untrusted code, such as clients running sandboxed Java Web Start applications or sandboxed Java applets (NVD).

The vulnerability is difficult to exploit and requires human interaction from a person other than the attacker. It can be exploited by an unauthenticated attacker with network access via multiple protocols (Oracle CPUJul2021).

Oracle released security patches to address this vulnerability in their July 2021 Critical Patch Update. Users are strongly recommended to update to the fixed versions: Java SE 7u311, 8u301, 11.0.12, or later versions. For Oracle GraalVM Enterprise Edition, users should update to versions after 20.3.2 and 21.1.0 (Oracle CPUJul2021).