Description
A vulnerability was found in OpenShift OSIN. It has been classified as problematic. This affects the function ClientSecretMatches/CheckClientSecret. The manipulation of the argument secret leads to observable timing discrepancy. The name of the patch is 8612686d6dda34ae9ef6b5a974e4b7accb4fea29. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216987.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenShift | OSIN | — | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/openshift/osin | < 1.0.2-0.20210113124101-8612686d6dda | 1.0.2-0.20210113124101-8612686d6dda | GHSA-m7qp-cj9p-gj85 |
Advisories 1
- WID-SEC-2024-1019 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 16, 2024
References
- https://vuldb.com/?id.216987 vdb-entry technical-description
- https://vuldb.com/?ctiid.216987 signature permissions-required
- https://github.com/openshift/osin/pull/200 issue-tracking
- https://github.com/openshift/osin/commit/8612686d6dda34ae9ef6b5a974e4b7accb4fea29 patch