CVE-2020-14341: red hat red hat single sign-on Covert Timing Channel

Vulnerability summary

CVE-2020-14341 is a medium (CVSS 4.0) Covert Timing Channel vulnerability in red hat red hat single sign-on. EPSS estimates a 0.96% chance of exploitation in the next 30 days, higher than 60.7% of scored vulnerabilities.

Timeline

1. 12-01-2021
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

The "Test Connection" available in v7.x of the Red Hat Single Sign On application console can permit an authorized user to cause SMTP connections to be attempted to arbitrary hosts and ports of the user's choosing, and originating from the RHSSO installation. By observing differences in the timings of these scans, an attacker may glean information about hosts and ports which they do not have access to scan directly.

• CWE-385Covert Timing ChannelCovert timing channels convey information by modulating some aspect of system behavior over time, so that the program receiving the information can observe system behavior and infer protected information.