CVE-2023-21971: 
Java vulnerability analysis and mitigation

CVE-2023-21971 is a vulnerability discovered in Oracle MySQL Connectors (component: Connector/J) affecting versions 8.0.32 and prior. The vulnerability was disclosed in Oracle's April 2023 Critical Patch Update (Oracle Advisory). It is classified as a difficult-to-exploit vulnerability that requires high privileges and network access via multiple protocols to compromise MySQL Connectors (NVD).

The vulnerability has been assigned a CVSS 3.1 Base Score of 5.3 (Medium) with the following vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:H. The attack requires high complexity, high privileges, and user interaction. The scope is unchanged, with low impacts on confidentiality and integrity but high impact on availability (Oracle Advisory, NetApp Advisory).

Successful exploitation of this vulnerability can result in multiple impacts: unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors, unauthorized update, insert or delete access to some of MySQL Connectors accessible data, and unauthorized read access to a subset of MySQL Connectors accessible data (NVD, NetApp Advisory).

The vulnerability is considered difficult to exploit and requires specific conditions: a high-privileged attacker with network access via multiple protocols, and successful attacks require human interaction from a person other than the attacker (Oracle Advisory, NetApp Advisory).

Oracle has released patches for this vulnerability in their April 2023 Critical Patch Update. Users are strongly recommended to update to versions newer than 8.0.32. For affected NetApp products, patches have been made available through the NetApp Support website, with specific fixes for various products including Active IQ Unified Manager and OnCommand Insight (Oracle Advisory, NetApp Advisory).