GitHub Advisoryadvisory · Maven

GHSA-5499-qjvh-6j7w Observable Discrepancy in Wildfly Elytron

MEDIUM Published 2022-05-24 Modified 2022-06-22 Official page ↗
Aliases
CVE-2021-3642
Ecosystem
Maven
Packages
org.wildfly.security:wildfly-elytron
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-203
Reviewed
2022-06-22

Affected packages

• Maven org.wildfly.security:wildfly-elytron: < 1.10.14 → fixed in 1.10.14 • Maven org.wildfly.security:wildfly-elytron: >= 1.11.0, < 1.15.5 → fixed in 1.15.5 • Maven org.wildfly.security:wildfly-elytron: >= 1.16.0, < 1.16.1 → fixed in 1.16.1

Description

A flaw was found in Wildfly Elytron where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality. This flaw affectes Wildfly Elytron versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final.

Related

Alias · CVE (1)

  • CVE-2021-3642 A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer… vulnerability

Weakness · CWE (1)

  • CWE-203 Observable Discrepancy weakness

References