CVE-2021-3642: Observable Discrepancy in Wildfly Elytron
Summary
CVE-2021-3642: Observable Discrepancy in Wildfly Elytron. Affects org.wildfly.security:wildfly-elytron across 3 version ranges.
< 1.10.14
>= 1.11.0, < 1.15.5
>= 1.16.0, < 1.16.1
Fixed in 1.10.14, 1.15.5 or 1.16.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wildfly Elytron is a security framework for the Wildfly application server that provides a unified security model across various subsystems. It offers features such as authentication, authorization, and secure communication. However, versions prior to 1.10.14.Final, 1.15.5.Final, and 1.16.1.Final are vulnerable to an observable discrepancy that can be exploited.
Vulnerability Detail
The vulnerability in Wildfly Elytron arises from a timing attack that can be performed on the ScramServer component when it is enabled. This attack can potentially compromise the confidentiality of sensitive information. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level. It affects versions prior to 1.10.14.Final, 1.15.5.Final, and 1.16.1.Final of Wildfly Elytron.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.10.141.10.14 -
>= 1.11.0, < 1.15.51.15.5 -
>= 1.16.0, < 1.16.11.16.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the fixed versions of Wildfly Elytron.
Conclusion
The vulnerability in Wildfly Elytron can be mitigated by upgrading to the fixed versions of the package. It is crucial to apply the recommended fix to ensure the security of the application. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.wildfly.security:wildfly-elytron →
FAQ
Wildfly Elytron is a security framework for the Wildfly application server that provides authentication, authorization, and secure communication capabilities.
This vulnerability can lead to a compromise of confidentiality, potentially exposing sensitive information.
A timing attack is a type of side-channel attack where an attacker exploits variations in the execution time of a cryptographic algorithm to gain information about secret values.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
To fix this vulnerability, upgrade Wildfly Elytron to version 1.10.14.Final, 1.15.5.Final, or 1.16.1.Final.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.wildfly.security:wildfly-elytron.
