medium5.3
CVE-2021-3642
Observable Discrepancy in Wildfly Elytron
Impact
A flaw was found in Wildfly Elytron where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality. This flaw affectes Wildfly Elytron versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.wildfly.security:wildfly-elytron | <= 1.10.13 | 1.10.14 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Wildfly Elytron | before 1.10.14 from 1.11.0 before 1.15.5 from 1.16.0 before 1.16.1 |
| Redhat | Build Of Quarkus | All versions |
| Redhat | Codeready Studio | Version 12.0 |
| Redhat | Data Grid | Version 8.0 |
| Redhat | Descision Manager | Version 7.0 |
| Redhat | Integration Camel K | All versions |
| Redhat | Integration Camel Quarkus | All versions |
| Redhat | Jboss Enterprise Application Platform | Version 7.0.0 |
| Redhat | Jboss Enterprise Application Platform Expansion Pack | All versions |
| Redhat | Jboss Fuse | Version 7.0.0 |
| Redhat | Openshift Application Runtimes | All versions |
| Redhat | Process Automation | Version 7.0 |