CVE-2021-3642

Published: Aug 5, 2021Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.6 / Impact: 3.6

Source: NVD

Description

A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality.

Affected (15)

Products: Redhat: Wildfly Elytron, Build Of Quarkus, Codeready Studio, Data Grid, Descision Manager, Integration Camel K, Integration Camel Quarkus, Jboss Enterprise Application Platform, Jboss Enterprise Application Platform Expansion Pack, Jboss Fuse, Openshift Application Runtimes, Process Automation · Quarkus: Quarkus

12 products

Integration Camel Quarkus

Jboss Enterprise Application Platform

Jboss Enterprise Application Platform Expansion Pack

Jboss Fuse

Openshift Application Runtimes

Process Automation

Quarkus

1 product

Quarkus

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Redhat Wildfly Elytron	Before 1.10.14
Redhat Wildfly Elytron	From 1.11.0 to 1.15.5
Redhat Wildfly Elytron	From 1.16.0 to 1.16.1

Configuration B

11 vulnerable

Vulnerable Software	Affected Versions
Redhat Build Of Quarkus	All versions
Redhat Codeready Studio	Version 12.0
Redhat Data Grid	Version 8.0
Redhat Descision Manager	Version 7.0
Redhat Integration Camel K	All versions
Redhat Integration Camel Quarkus	All versions
Redhat Jboss Enterprise Application Platform	Version 7.0.0
Redhat Jboss Enterprise Application Platform Expansion Pack	All versions
Redhat Jboss Fuse	Version 7.0.0
Redhat Openshift Application Runtimes	All versions
Redhat Process Automation	Version 7.0

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Quarkus Quarkus	Up to 2.1.4

Related CWEs

CWE-203

Observable Discrepancy

The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

References (2)

https://bugzilla.redhat.com/show_bug.cgi?id=1981407

Source: secalert@redhat.com

Issue TrackingVendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1981407

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

Timeline

No history available yet.