GitHub Advisoryadvisory · Go

GHSA-m7qp-cj9p-gj85 OpenShift OSIN vulnerable to Observable Timing Discrepancy

MEDIUM Published 2022-12-28 Modified 2024-03-01 Official page ↗
Aliases
CVE-2021-4294
Ecosystem
Go
Packages
github.com/openshift/osin
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-203, CWE-208
Reviewed
2023-01-09

Affected packages

• Go github.com/openshift/osin: < 1.0.2-0.20210113124101-8612686d6dda → fixed in 1.0.2-0.20210113124101-8612686d6dda

Description

A vulnerability was found in OpenShift OSIN. It has been classified as problematic. This affects the function `ClientSecretMatches/CheckClientSecret`. The manipulation of the argument secret leads to observable timing discrepancy. The name of the patch is 8612686d6dda34ae9ef6b5a974e4b7accb4fea29. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216987.

Related

Alias · CVE (1)

  • CVE-2021-4294 A vulnerability was found in OpenShift OSIN. vulnerability

Weakness · CWE (2)

  • CWE-203 Observable Discrepancy weakness
  • CWE-208 Observable Timing Discrepancy weakness

References