Bug 1981407 (CVE-2021-3642)

Summary:	CVE-2021-3642 wildfly-elytron: possible timing attack in ScramServer
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aboyko, aileenc, akoufoud, alazarot, almorale, anstephe, asoldano, atangrin, avibelli, bbaranow, bgeorges, bibryam, bmaxwell, brian.stansberry, cdewolf, chazlett, clement.escoffier, cmoulliard, dandread, darran.lofthouse, dkreling, dosoudil, drieden, eleandro, etirelli, fjuma, ggaughan, gmalinko, gsmet, hamadhan, hbraun, ibek, ikanello, iweiss, janstey, jnethert, jochrist, jpallich, jperkins, jrokos, jstastny, jwon, krathod, kverlaen, kwills, lgao, lthon, mnovotny, msochure, msvehla, mszynkie, nwallace, pantinor, pdrozd, peholase, pgallagh, pjindal, pmackay, probinso, rguimara, rrajasek, rruss, rstancel, rsvoboda, sbiarozk, sdouglas, smaestri, sthorger, tom.jenkinson, tzimanyi, yborgess
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	Wildfly Elytron 1.10.14.Final, Wildfly Elytron 1.15.5.Final, Wildfly Elytron 1.16.1.Final	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in Wildfly Elytron where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-20 14:08:24 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1978312, 1981408

Description Guilherme de Almeida Suckevicz 2021-07-12 13:58:30 UTC

A flaw was found in Wildfly Elytron where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality.

Reference:
https://issues.redhat.com/browse/ELY-2147

Comment 12 errata-xmlrpc 2021-09-23 16:16:05 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

Via RHSA-2021:3656 https://access.redhat.com/errata/RHSA-2021:3656

Comment 13 errata-xmlrpc 2021-09-23 16:24:41 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

Via RHSA-2021:3658 https://access.redhat.com/errata/RHSA-2021:3658

Comment 14 errata-xmlrpc 2021-09-23 16:30:29 UTC

This issue has been addressed in the following products:

  EAP 7.4.1 release

Via RHSA-2021:3660 https://access.redhat.com/errata/RHSA-2021:3660

Comment 15 errata-xmlrpc 2021-10-20 11:30:13 UTC

This issue has been addressed in the following products:

  Red Hat build of Quarkus 2.2.3

Via RHSA-2021:3880 https://access.redhat.com/errata/RHSA-2021:3880

Comment 16 Product Security DevOps Team 2021-10-20 14:08:24 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-3642

Comment 17 errata-xmlrpc 2021-11-23 10:35:46 UTC

This issue has been addressed in the following products:

  Red Hat Integration

Via RHSA-2021:4767 https://access.redhat.com/errata/RHSA-2021:4767

Comment 18 errata-xmlrpc 2021-12-15 14:35:22 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7

Via RHSA-2021:5150 https://access.redhat.com/errata/RHSA-2021:5150

Comment 19 errata-xmlrpc 2021-12-15 14:40:57 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8

Via RHSA-2021:5151 https://access.redhat.com/errata/RHSA-2021:5151

Comment 20 errata-xmlrpc 2021-12-15 14:42:37 UTC

This issue has been addressed in the following products:

  EAP 7.3.10 GA

Via RHSA-2021:5154 https://access.redhat.com/errata/RHSA-2021:5154

Comment 21 errata-xmlrpc 2021-12-15 14:49:47 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6

Via RHSA-2021:5149 https://access.redhat.com/errata/RHSA-2021:5149

Comment 22 errata-xmlrpc 2021-12-15 19:08:52 UTC

This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.4.10

Via RHSA-2021:5170 https://access.redhat.com/errata/RHSA-2021:5170

Comment 23 errata-xmlrpc 2022-01-17 12:02:57 UTC

This issue has been addressed in the following products:

  Red Hat EAP-XP 2 via EAP 7.3.x base

Via RHSA-2022:0146 https://access.redhat.com/errata/RHSA-2022:0146

Comment 24 errata-xmlrpc 2022-02-14 13:06:46 UTC

This issue has been addressed in the following products:

  Red Hat Data Grid 8.3.0

Via RHSA-2022:0520 https://access.redhat.com/errata/RHSA-2022:0520

Comment 25 errata-xmlrpc 2022-04-12 19:06:31 UTC

This issue has been addressed in the following products:

  Red Hat Support for Spring Boot 2.5.10

Via RHSA-2022:1179 https://access.redhat.com/errata/RHSA-2022:1179

Comment 26 errata-xmlrpc 2022-07-07 14:20:43 UTC

This issue has been addressed in the following products:

  Red Hat Fuse 7.11

Via RHSA-2022:5532 https://access.redhat.com/errata/RHSA-2022:5532

Comment 27 errata-xmlrpc 2022-08-04 04:46:44 UTC

This issue has been addressed in the following products:

  RHPAM 7.13.0 async

Via RHSA-2022:5903 https://access.redhat.com/errata/RHSA-2022:5903