CVEvulnerability

CVE-2021-3642

5.3 MEDIUM Published 2021-08-05 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-08-05
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
3.5 LOW — AV:N/AC:M/Au:S/C:P/I:N/A:N
Weaknesses
CWE-203

Description

A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality.

Affected configurations

• redhat wildfly elytron (< 1.10.14) • redhat wildfly elytron (>= 1.11.0 < 1.15.5) • redhat wildfly elytron (>= 1.16.0 < 1.16.1) • redhat build of quarkus • redhat codeready studio 12.0 • redhat data grid 8.0 • redhat descision manager 7.0 • redhat integration camel k • redhat integration camel quarkus • redhat jboss enterprise application platform 7.0.0 • redhat jboss enterprise application platform expansion pack • redhat jboss fuse 7.0.0 • redhat openshift application runtimes • redhat process automation 7.0 • quarkus quarkus (<= 2.1.4)

Related

Weakness · CWE (1)

  • CWE-203 Observable Discrepancy weakness

References