Is CVE-2021-3642 actively exploited?

CVE-2021-3642 has no public evidence of in-the-wild exploitation as of 2024-11-21.

What is the CVSS score for CVE-2021-3642?

CVE-2021-3642 has a CVSS score of 5.3 (MEDIUM severity). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N.

How do I patch CVE-2021-3642?

Patch guidance is available from redhat security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2021-3642.

CVE-2021-3642 - remediation guidance & executive summary

Q: Which products are affected by CVE-2021-3642?

15 products: redhat wildfly elytron, redhat wildfly elytron, redhat wildfly elytron, redhat build of quarkus, redhat codeready studio, and 10 more.

Description

A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality.

CVSS Metrics

Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector: network
Complexity: high
Privileges: low
User Action: none
Scope: unchanged
Confidentiality: high
Integrity: none
Availability: none
Weaknesses: CWE-203 CWE-203

Metadata

Primary Vendor: REDHAT
Published: 8/5/2021
Last Modified: 11/21/2024
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

redhat : wildfly_elytronredhat : wildfly_elytronredhat : wildfly_elytronredhat : build_of_quarkusredhat : codeready_studioredhat : data_gridredhat : descision_managerredhat : integration_camel_kredhat : integration_camel_quarkusredhat : jboss_enterprise_application_platformredhat : jboss_enterprise_application_platform_expansion_packredhat : jboss_fuseredhat : openshift_application_runtimesredhat : process_automationquarkus : quarkus

Remediation Guidance

Executive Summary

View on NIST NVD