Medium severity · published Aug 5, 2021
CVE-2021-3642
A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if…
5.3
CVSS
0.8%
EPSS
No
On KEV
Description
A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BO
Build OF Quarkus · Redhat
All versions, or not specified · source: NVD
CS
Codeready Studio · Redhat
12.0 · source: NVD
DG
Data Grid · Redhat
8.0 · source: NVD
DM
Descision Manager · Redhat
7.0 · source: NVD
IC
Integration Camel K · Redhat
All versions, or not specified · source: NVD
IC
Integration Camel Quarkus · Redhat
All versions, or not specified · source: NVD
JE
Jboss Enterprise Application Platform · Redhat
7.0.0 · source: NVD
JE
Jboss Enterprise Application Platform Expansion Pack · Redhat
All versions, or not specified · source: NVD
JF
Jboss Fuse · Redhat
7.0.0 · source: NVD
OA
Openshift Application Runtimes · Redhat
All versions, or not specified · source: NVD
PA
Process Automation · Redhat
7.0 · source: NVD
QU
Quarkus · Quarkus
through 2.1.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-3642
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-3642
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1981407
More from Quarkus
9.8
CVE-2023-6267
A flaw was found in the json payload
9.8
CVE-2022-4116
A vulnerability was found in quarkus
9.8
CVE-2022-2466
It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior
9.8
CVE-2022-21724
pgjdbc is the offical PostgreSQL JDBC Driver
9.1
CVE-2024-12225
A vulnerability was found in Quarkus in the quarkus-security-webauthn module