GitHub Advisoryadvisory · Maven

GHSA-jmj6-p2j9-68cp Wildfly-elytron possibly vulnerable to timing attacks via use of unsafe comparator

HIGH Published 2023-01-13 Modified 2023-01-25 Official page ↗
Aliases
CVE-2022-3143
Ecosystem
Maven
Packages
org.wildfly.security:wildfly-elytron
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-203, CWE-208
Reviewed
2023-01-13

Affected packages

• Maven org.wildfly.security:wildfly-elytron: < 1.15.15.Final → fixed in 1.15.15.Final • Maven org.wildfly.security:wildfly-elytron: >= 1.16.0.CR1, < 1.20.3.Final → fixed in 1.20.3.Final

Description

wildfly-elytron: possible timing attacks via use of unsafe comparator. A flaw was found in Wildfly-elytron. Wildfly-elytron uses `java.util.Arrays.equals` in several places, which is unsafe and vulnerable to timing attacks. To compare values securely, use `java.security.MessageDigest.isEqual` instead. This flaw allows an attacker to access secure information or impersonate an authed user.

Related

Alias · CVE (1)

  • CVE-2022-3143 wildfly-elytron: possible timing attacks via use of unsafe comparator. vulnerability

Weakness · CWE (2)

  • CWE-203 Observable Discrepancy weakness
  • CWE-208 Observable Timing Discrepancy weakness

References