GitHub Advisoryadvisory · Maven

GHSA-xwg3-qrcg-w9x6 Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18

MEDIUM Published 2021-04-19 Modified 2021-04-23 Official page ↗
Aliases
CVE-2021-31404
Ecosystem
Maven
Packages
com.vaadin:flow-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-203, CWE-208
Reviewed
2021-04-16

Affected packages

• Maven com.vaadin:flow-server: >= 1.0.0, < 1.0.14 → fixed in 1.0.14 • Maven com.vaadin:flow-server: >= 1.1.0, < 2.4.7 → fixed in 2.4.7 • Maven com.vaadin:flow-server: >= 3.0.0, < 5.0.3 → fixed in 5.0.3

Description

Non-constant-time comparison of CSRF tokens in UIDL request handler in `com.vaadin:flow-server` versions 1.0.0 through 1.0.13 (Vaadin 10.0.0 through 10.0.16), 1.1.0 prior to 2.0.0 (Vaadin 11 through 13), 2.0.0 through 2.4.6 (Vaadin 14.0.0 through 14.4.6), 3.0.0 prior to 5.0.0 (Vaadin 15 prior to 18), and 5.0.0 through 5.0.2 (Vaadin 18.0.0 through 18.0.5) allows attacker to guess a security token via timing attack. • https://vaadin.com/security/cve-2021-31404

Related

Alias · CVE (1)

  • CVE-2021-31404 Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.13 (Vaadin 10.0.0… vulnerability

Weakness · CWE (2)

  • CWE-203 Observable Discrepancy weakness
  • CWE-208 Observable Timing Discrepancy weakness

References