CVE-2021-3642
Observable Discrepancy in Wildfly Elytron
5.3
MEDIUM
CVSS 3.1
EPSS 0.27%
Description
A flaw was found in Wildfly Elytron where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality. This flaw affectes Wildfly Elytron versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final.
How to fix CVE-2021-3642
To remediate CVE-2021-3642, upgrade the affected package to a fixed version below.
- —upgrade to 1.10.14 or later
Is CVE-2021-3642 being exploited?
Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 1.10.14
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM5.3 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N |