A vulnerability was found in OpenShift OSIN. It has been classified as problematic. This affects the function ClientSecretMatches/CheckClientSecret. The manipulation of the argument secret leads to observable timing discrepancy. The name of the patch is 8612686d6dda34ae9ef6b5a974e4b7accb4fea29. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216987.

Affected: Go: github.com/openshift/osin

A vulnerability was found in OpenShift OSIN. It has been classified as problematic. This affects the function `ClientSecretMatches/CheckClientSecret`. The manipulation of the argument secret leads to observable timing discrepancy. The name of the patch is 8612686d6dda34ae9ef6b5a974e4b7accb4fea29. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216987.

dns: Denial of Service (DoS) osin: manipulation of the argument secret leads to observable timing discrepancy mongo-go-driver: specific cstrings input may not be properly validated cortex: Grafana Cortex directory traversal go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents helm: Denial of service through through repository index file helm: Denial of service through schema file golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding go-getter: go-getter vulnerable to denial of service via malicious compressed archive vault: Vault’s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration File hashicorp/vault: Vault’s PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata openshift: OCP & FIPS mode golang.org/x/net/html: Cross site scripting OpenShift: modification of node role labels hashicorp/vault: Cache-Timing Attacks During Seal and Unseal Operations helm: getHostByName Function Information Disclosure containerd: Supplementary groups are not set up properly word-wrap: ReDoS tough-cookie: prototype pollution in cookie memstore runc: volume mount race condition (regression of CVE-2019-19921) golang-github-gin-gonic-gin: Gin Web Framework does not properly sanitize filename parameter of Context.FileAttachment function goproxy: Denial of service (DoS) via unspecified vectors. golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)…

Ein entfernter Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um Informationen offenzulegen oder um Sicherheitsmaßnahmen zu umgehen.