Vulnerabilities > CVE-2021-4294 - Information Exposure Through Discrepancy vulnerability in Redhat Openshift Container Platform and Openshift Osin
Attack vector
NETWORK Attack complexity
HIGH Privileges required
NONE Confidentiality impact
HIGH Integrity impact
NONE Availability impact
NONE Summary
A vulnerability was found in OpenShift OSIN. It has been classified as problematic. This affects the function ClientSecretMatches/CheckClientSecret. The manipulation of the argument secret leads to observable timing discrepancy. The name of the patch is 8612686d6dda34ae9ef6b5a974e4b7accb4fea29. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216987.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 3 |
Common Weakness Enumeration (CWE)
References
- https://github.com/openshift/osin/commit/8612686d6dda34ae9ef6b5a974e4b7accb4fea29
- https://github.com/openshift/osin/commit/8612686d6dda34ae9ef6b5a974e4b7accb4fea29
- https://github.com/openshift/osin/pull/200
- https://github.com/openshift/osin/pull/200
- https://vuldb.com/?ctiid.216987
- https://vuldb.com/?ctiid.216987
- https://vuldb.com/?id.216987
- https://vuldb.com/?id.216987