// For flags

CVE-2022-3143

wildfly-elytron: possible timing attacks via use of unsafe comparator

Severity Score

7.4
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

wildfly-elytron: possible timing attacks via use of unsafe comparator. A flaw was found in Wildfly-elytron. Wildfly-elytron uses java.util.Arrays.equals in several places, which is unsafe and vulnerable to timing attacks. To compare values securely, use java.security.MessageDigest.isEqual instead. This flaw allows an attacker to access secure information or impersonate an authed user.

wildfly-elytron: posibles ataques de sincronización mediante el uso de un comparador inseguro. Se encontró una falla en Wildfly-elytron. Wildfly-elytron utiliza java.util.Arrays.equals en varios lugares, lo que no es seguro y es vulnerable a ataques de sincronización. Para comparar valores de forma segura, utilice java.security.MessageDigest.isEqual en su lugar. Esta falla permite a un atacante acceder a información segura o hacerse pasar por un usuario autenticado.

A flaw was found in Wildfly-elytron. Wildfly-elytron uses java.util.Arrays.equals in several places, which is unsafe and vulnerable to timing attacks. To compare values securely, use java.security.MessageDigest.isEqual instead. This flaw allows an attacker to access secure information or impersonate an authed user.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-09-06 CVE Reserved
  • 2023-01-11 CVE Published
  • 2024-08-03 CVE Updated
  • 2024-08-03 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-203: Observable Discrepancy
  • CWE-208: Observable Timing Discrepancy
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Redhat
Search vendor "Redhat"
 Wildfly Elytron
Search vendor "Redhat" for product "Wildfly Elytron"
 1.15.15
Search vendor "Redhat" for product "Wildfly Elytron" and version "1.15.15"
-
Affected
Redhat
Search vendor "Redhat"
 Jboss Enterprise Application Platform
Search vendor "Redhat" for product "Jboss Enterprise Application Platform"
 7.0.0
Search vendor "Redhat" for product "Jboss Enterprise Application Platform" and version "7.0.0"
-
Affected