Cyber Resilience

CVE-2021-38153

Medium

Published: 22 September 2021

Published
22 September 2021
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0152 81.6th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-38153 is a medium-severity Observable Discrepancy (CWE-203) vulnerability in Oracle Financial Services Enterprise Case Management. Its CVSS base score is 5.9 (Medium).

Operationally, ranked in the top 18.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or…

more

3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

apache
kafka
2.8.0 · 2.0.0 — 2.6.3 · 2.7.0 — 2.7.2
quarkus
quarkus
≤ 2.2.4
oracle
communications brm - elastic charging engine
12.0.0.5.0 · ≤ 12.0.0.4.6
oracle
communications cloud native core policy
1.15.0
oracle
financial services analytical applications infrastructure
8.0.6.0 — 8.0.9.0 · 8.1.0.0.0 — 8.1.20
oracle
financial services behavior detection platform
8.1.1.0, 8.1.1.1, 8.1.2.0 · 8.0.6.0.0 — 8.0.8.0
oracle
financial services enterprise case management
8.0.7.1, 8.0.7.2, 8.0.8.0, 8.0.8.1, 8.1.1.0
oracle
primavera unifier
18.8, 19.12, 20.12, 21.12

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-203

Misdirection can normalize or falsify responses to eliminate observable discrepancies that aid reconnaissance.

addresses: CWE-203

Observable discrepancies in system behavior can be modulated to create covert storage or timing channels; the required analysis detects and constrains such avenues.

addresses: CWE-203

Prevents attackers from using observable differences in error responses to infer internal system details or state.

References