PT-2021-3878 · Red Hat · Wildfly Elytron

Guilherme De Almeida Suckevicz · Published 2021-06-30 · Updated 2022-05-24 · CVE-2021-3642

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Wildfly Elytron versions prior to 1.10.14.Final Wildfly Elytron versions prior to 1.15.5.Final Wildfly Elytron versions prior to 1.16.1.Final

Description A flaw was found in Wildfly Elytron where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this issue is confidentiality. This flaw is related to the implementation of the ScramServer class, which may lead to information disclosure due to inconsistency. Exploitation of this issue may allow a remote attacker to gain unauthorized access to protected information.

Recommendations For versions prior to 1.10.14.Final, update to version 1.10.14.Final or later. For versions prior to 1.15.5.Final, update to version 1.15.5.Final or later. For versions prior to 1.16.1.Final, update to version 1.16.1.Final or later. As a temporary workaround, consider disabling the ScramServer feature until a patch is available.

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

BDU:2021-04259

CVE-2021-3642

GHSA-5499-QJVH-6J7W

RHSA-2021:3656

RHSA-2021:3658

RHSA-2021:5149

RHSA-2021:5150

RHSA-2021:5151

Affected Products

Wildfly Elytron

References · 9

• https://bugzilla.redhat.com/show_bug.cgi?id=1981407 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3642 · Security Note
• https://osv.dev/vulnerability/CVE-2021-3642 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5499-qjvh-6j7w · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04259 · Security Note
• https://access.redhat.com/security/cve/cve-2021-3642 · Note
• https://t.me/cibsecurity/26904 · Telegram Post
• https://t.me/cvenotify/21238 · Telegram Post
• https://issues.redhat.com/browse/ELY-2147 · Note