CVSS 3.1
5.9 mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2021-4294
Medium (5.9) in redhat. EPSS 0.7% chance of exploitation in the next 30 days. Fixed in github.com/openshift/osin 1.0.2-0.20210113124101-8612686d6dda.
A vulnerability was found in OpenShift OSIN. It has been classified as problematic. This affects the function ClientSecretMatches/CheckClientSecret. The manipulation of the argument secret leads to observable timing discrepancy. The name of the patch is 8612686d6dda34ae9ef6b5a974e4b7accb4fea29. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216987.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-203, CWE-208
- Published
- Modified
- Record from
- the NVD, synced
Affected
- redhat:openshift_container_platform
- redhat:openshift_osin
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-m7qp-cj9p-gj85 | Go | github.com/openshift/osin | <1.0.2-0.20210113124101-8612686d6dda | 1.0.2-0.20210113124101-8612686d6dda |
| GO-2022-1201 | Go | github.com/openshift/osin | <1.0.2-0.20210113124101-8612686d6dda | 1.0.2-0.20210113124101-8612686d6dda |