CVE-2021-4294: Observable Discrepancy

December 28, 2022 (updated January 9, 2023)

A vulnerability was found in OpenShift OSIN. It has been classified as problematic. This affects the function ClientSecretMatches/CheckClientSecret. The manipulation of the argument secret leads to observable timing discrepancy. The name of the patch is 8612686d6dda34ae9ef6b5a974e4b7accb4fea29. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216987.

References

github.com/advisories/GHSA-m7qp-cj9p-gj85
github.com/openshift/osin/commit/8612686d6dda34ae9ef6b5a974e4b7accb4fea29
github.com/openshift/osin/pull/200
nvd.nist.gov/vuln/detail/CVE-2021-4294
vuldb.com/?ctiid.216987
vuldb.com/?id.216987

Code Behaviors & Features

Detect and mitigate CVE-2021-4294 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →