REDHAT-BUG-2156871: Medium severity red hat openshift osin vulnerability
A vulnerability was found in OpenShift OSIN. It has been classified as problematic. This affects the function ClientSecretMatches/CheckClientSecret. The manipulation of the argument secret leads to observable timing discrepancy. The name of the patch is 8612686d6dda34ae9ef6b5a974e4b7accb4fea29. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216987.
https://vuldb.com/?id.216987 https://github.com/openshift/osin/commit/8612686d6dda34ae9ef6b5a974e4b7accb4fea29 https://github.com/openshift/osin/pull/200 https://vuldb.com/?ctiid.216987
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2156871?
REDHAT-BUG-2156871 is classified as a problematic vulnerability.
How does REDHAT-BUG-2156871 affect OpenShift OSIN?
REDHAT-BUG-2156871 affects the ClientSecretMatches/CheckClientSecret function, leading to observable timing discrepancies.
How do I fix REDHAT-BUG-2156871?
To fix REDHAT-BUG-2156871, apply the patch identified by commit 8612686d6dda34ae9ef6b5a974e4b7accb4fea29.
What type of vulnerability is REDHAT-BUG-2156871?
REDHAT-BUG-2156871 is a timing attack vulnerability that can exploit the argument manipulation of the secret.
Is there a workaround for REDHAT-BUG-2156871?
Currently, there are no known workarounds for REDHAT-BUG-2156871; applying the fix is recommended.