CVE-2021-4294: OpenShift OSIN CheckClientSecret timing discrepancy
A vulnerability was found in OpenShift OSIN. It has been classified as problematic. This affects the function ClientSecretMatches/CheckClientSecret. The manipulation of the argument secret leads to observable timing discrepancy. The name of the patch is 8612686d6dda34ae9ef6b5a974e4b7accb4fea29. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216987.
Other sources
A vulnerability was found in OpenShift OSIN. It has been classified as problematic. This affects the function ClientSecretMatches/CheckClientSecret. The manipulation of the argument secret leads to observable timing discrepancy. The name of the patch is 8612686d6dda34ae9ef6b5a974e4b7accb4fea29. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216987.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-4294?
The severity of CVE-2021-4294 is medium with a CVSS score of 5.9.
What is the affected software for CVE-2021-4294?
The affected software for CVE-2021-4294 includes OpenShift OSIN version 1.0.2-0.20210113124101-8612686d6dda and Redhat Openshift Container Platform version 4.0.
How can I fix the CVE-2021-4294 vulnerability in OpenShift OSIN?
To fix the CVE-2021-4294 vulnerability in OpenShift OSIN, update to version 1.0.2-0.20210113124101-8612686d6dda or later.
Is there a patch available for CVE-2021-4294?
Yes, a patch is available for CVE-2021-4294. The patch can be found in the commit 8612686d6dda34ae9ef6b5a974e4b7accb4fea29.
Where can I find more information about CVE-2021-4294?
More information about CVE-2021-4294 can be found in the National Vulnerability Database (NVD) at https://nvd.nist.gov/vuln/detail/CVE-2021-4294.