Vulnerability · Published Dec 28, 2022 · Assigned by VulDB

CVE-2021-4294OpenShift OSIN CheckClientSecret timing discrepancy

Low 2.6

In plain English

A low-severity security flaw in OSIN from OpenShift. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)2.6Low

Exploit odds (30 days)0.7%top 45.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in OpenShift OSIN. It has been classified as problematic. This affects the function ClientSecretMatches/CheckClientSecret. The manipulation of the argument secret leads to observable timing discrepancy. The name of the patch is 8612686d6dda34ae9ef6b5a974e4b7accb4fea29. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216987.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/openshift/osin	1.0.2-0.20210113124101-8612686d6dda	GHSA-m7qp-cj9p-gj85
Go	github.com/openshift/osin	1.0.2-0.20210113124101-8612686d6dda	GO-2022-1201

Affected products (as reported)

Vendor	Product	Versions
OpenShift	OSIN	n/a

Weakness: CWE-208 · Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://vuldb.com/?id.216987 vdb-entry, technical-description
https://vuldb.com/?ctiid.216987 signature, permissions-required
https://github.com/openshift/osin/pull/200 issue-tracking
https://github.com/openshift/osin/commit/8612686d6dda34ae9ef6b5a974e4b7accb4fea29 patch