What is GHSA-m7qp-cj9p-gj85?

GHSA-m7qp-cj9p-gj85 is a security advisory published by GitHub Security Advisories with Medium severity. OpenShift OSIN vulnerable to Observable Timing Discrepancy

Which CVE IDs does GHSA-m7qp-cj9p-gj85 cover?

GHSA-m7qp-cj9p-gj85 covers the following CVE IDs: CVE-2021-4294. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-m7qp-cj9p-gj85?

GHSA-m7qp-cj9p-gj85 has a CVSS v3 base score of 5.9, published by GitHub Security Advisories.

Which products are affected by GHSA-m7qp-cj9p-gj85?

GHSA-m7qp-cj9p-gj85 affects 1 product, including: go/github.com/openshift/osin:\u003c 1.0.2-0.20210113124101-8612686d6dda.

GHSA-m7qp-cj9p-gj85MediumCVSS 5.9

OpenShift OSIN vulnerable to Observable Timing Discrepancy

Vendor

GitHub Security Advisories

Published

December 28, 2022

Last Modified

March 1, 2024

🔗 CVE IDs covered (1)

CVE-2021-4294 →

📋 Description

A vulnerability was found in OpenShift OSIN. It has been classified as problematic. This affects the function ClientSecretMatches/CheckClientSecret. The manipulation of the argument secret leads to observable timing discrepancy. The name of the patch is 8612686d6dda34ae9ef6b5a974e4b7accb4fea29. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216987.

🎯 Affected products1

go/github.com/openshift/osin:< 1.0.2-0.20210113124101-8612686d6dda

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2021-4294
https://github.com/openshift/osin/pull/200
https://github.com/openshift/osin/commit/8612686d6dda34ae9ef6b5a974e4b7accb4fea29
https://vuldb.com/?ctiid.216987
https://pkg.go.dev/vuln/GO-2022-1201
https://vuldb.com/?id.216987
https://github.com/advisories/GHSA-m7qp-cj9p-gj85