CVSS 3.1
5.3 mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NCVE-2021-3642
Medium (5.3). EPSS 0.8% chance of exploitation in the next 30 days. Fixed in org.wildfly.security:wildfly-elytron 1.10.14, 1.15.5, 1.16.1.
A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality.
Severity
- EPSS
- 0.8% chance of exploitation in the next 30 days; higher than 58% of CVEs (scores of 2026-10-31)
- CWE
- CWE-203
- Published
- Modified
- Record from
- the NVD, synced
Affected
- quarkus:quarkus
- redhat:build_of_quarkus
- redhat:codeready_studio
- redhat:data_grid
- redhat:descision_manager
- redhat:integration_camel_k
- redhat:integration_camel_quarkus
- redhat:jboss_enterprise_application_platform
- redhat:jboss_enterprise_application_platform_expansion_pack
- redhat:jboss_fuse
- redhat:openshift_application_runtimes
- redhat:process_automation
- redhat:wildfly_elytron
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-5499-qjvh-6j7w | Maven | org.wildfly.security:wildfly-elytron | <1.10.14 | 1.10.14 |
| GHSA-5499-qjvh-6j7w | Maven | org.wildfly.security:wildfly-elytron | >=1.11.0 <1.15.5 | 1.15.5 |
| GHSA-5499-qjvh-6j7w | Maven | org.wildfly.security:wildfly-elytron | >=1.16.0 <1.16.1 | 1.16.1 |