VulnerableCode Package Details - pkg:maven/org.wildfly.security/wildfly-elytron@1.15.12.Final

Staging Environment: Content and features may be unstable or change without notice.

Search for packages

Package details: pkg:maven/org.wildfly.security/wildfly-elytron@1.15.12.Final

Essentials
History (4)

purl	pkg:maven/org.wildfly.security/wildfly-elytron@1.15.12.Final

Next non-vulnerable version	1.15.15.Final
Latest non-vulnerable version	2.6.2.Final
Risk	4.0

Vulnerabilities affecting this package (1)

Vulnerability	Summary	Fixed by
VCID-6ssa-j1q1-c3cs Aliases: CVE-2022-3143 GHSA-jmj6-p2j9-68cp	Wildfly-elytron possibly vulnerable to timing attacks via use of unsafe comparator wildfly-elytron: possible timing attacks via use of unsafe comparator. A flaw was found in Wildfly-elytron. Wildfly-elytron uses `java.util.Arrays.equals` in several places, which is unsafe and vulnerable to timing attacks. To compare values securely, use `java.security.MessageDigest.isEqual` instead. This flaw allows an attacker to access secure information or impersonate an authed user.	1.15.15.Final Affected by 0 other vulnerabilities. 1.20.3.Final Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-6ssa-j1q1-c3cs
Aliases:
CVE-2022-3143
GHSA-jmj6-p2j9-68cp

Wildfly-elytron possibly vulnerable to timing attacks via use of unsafe comparator wildfly-elytron: possible timing attacks via use of unsafe comparator. A flaw was found in Wildfly-elytron. Wildfly-elytron uses `java.util.Arrays.equals` in several places, which is unsafe and vulnerable to timing attacks. To compare values securely, use `java.security.MessageDigest.isEqual` instead. This flaw allows an attacker to access secure information or impersonate an authed user.

1.15.15.Final
Affected by 0 other vulnerabilities.

1.20.3.Final
Affected by 1 other vulnerability.

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-16T22:19:30.064623+00:00	GitLab Importer	Affected by	VCID-6ssa-j1q1-c3cs	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.wildfly.security/wildfly-elytron/CVE-2022-3143.yml	38.4.0
2026-04-11T23:37:20.751784+00:00	GitLab Importer	Affected by	VCID-6ssa-j1q1-c3cs	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.wildfly.security/wildfly-elytron/CVE-2022-3143.yml	38.3.0
2026-04-02T23:41:42.835598+00:00	GitLab Importer	Affected by	VCID-6ssa-j1q1-c3cs	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.wildfly.security/wildfly-elytron/CVE-2022-3143.yml	38.1.0
2026-04-01T18:04:20.393248+00:00	GitLab Importer	Affected by	VCID-6ssa-j1q1-c3cs	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.wildfly.security/wildfly-elytron/CVE-2022-3143.yml	38.0.0