CVE-2021-4294CWE-208

OpenShift OSIN CheckClientSecret timing discrepancy

Low · published December 28, 2022

CVSS v3.1
2.6
EPSS
1%
Percentile
52.4
In the wild
Unconfirmed
What it is

A vulnerability was found in OpenShift OSIN. It has been classified as problematic. This affects the function ClientSecretMatches/CheckClientSecret. The manipulation of the argument secret leads to observable timing discrepancy. The name of the patch is 8612686d6dda34ae9ef6b5a974e4b7accb4fea29. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216987.

The record
Technical detail
CVSS v3.1
2.6 · LOW
Vector
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00694 · 52.4th percentile
Weakness
CWE-208 · Observable Timing Discrepancy
Published
2022-12-28T16:51Z
EPSS history
Timeline
  • 28 DEC 16:51Z
    OpenShift OSIN CheckClientSecret timing discrepancy
    cvelistv5