CVE-2021-4294: OpenShift OSIN vulnerable to Observable Timing Discrepancy
5.9
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.32387%
CWE
Published
12/28/2022
Updated
3/1/2024
KEV Status
No
Technology
Go
GoTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/openshift/osin | go | < 1.0.2-0.20210113124101-8612686d6dda | 1.0.2-0.20210113124101-8612686d6dda |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from using insecure string comparisons in authentication checks. Both functions originally used direct equality checks (==) which have variable execution times depending on input matches. The patch replaced these with crypto/subtle.ConstantTimeCompare to ensure constant-time comparisons. The commit diff clearly shows these functions were modified to address timing vulnerabilities, and the CWE-208 classification directly matches this type of weakness.