CVE-2021-4294
Low
Description
A vulnerability was found in OpenShift OSIN. It has been classified as problematic. This affects the function ClientSecretMatches/CheckClientSecret. The manipulation of the argument secret leads to observable timing discrepancy. The name of the patch is 8612686d6dda34ae9ef6b5a974e4b7accb4fea29. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216987.
SeverityLow
CVSS2.6
Exploit probability—
Product
Redhat Openshift Container Platform
PublishedDec 28, 2022
First seenDec 28, 2022
Weakness typeCWE-208CWE-208
How to fix
Update
- github.com/openshift/osin1.0.2-0.20210113124101-8612686d6dda or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat openshift_container_platform | 4.0 | — |
| redhat openshift_osin | 1.0.0, 1.0.1 | — |
| github.com/openshift/osinGo | v < 1.0.2-0.20210113124101-8612686d6dda | 1.0.2-0.20210113124101-8612686d6dda |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.