GitHub Advisoryadvisory · Maven

GHSA-qc2p-q7x9-v64p Covert Timing Channel in Apache CXF

HIGH Published 2022-05-13 Modified 2023-12-21 Official page ↗
Aliases
CVE-2017-3156
Ecosystem
Maven
Packages
org.apache.cxf.karaf:apache-cxf
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-385
Reviewed
2022-07-01

Affected packages

• Maven org.apache.cxf.karaf:apache-cxf: < 3.0.13 → fixed in 3.0.13 • Maven org.apache.cxf.karaf:apache-cxf: >= 3.1.0, < 3.1.10 → fixed in 3.1.10

Description

The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks.

Related

Alias · CVE (1)

  • CVE-2017-3156 The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC… vulnerability

Weakness · CWE (1)

  • CWE-385 Covert Timing Channel weakness

References