Search for packages
| purl | pkg:maven/org.wildfly.security/wildfly-elytron@1.15.5.Final |
| Next non-vulnerable version | 1.15.15.Final |
| Latest non-vulnerable version | 2.6.2.Final |
| Risk | 4.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-6ssa-j1q1-c3cs
Aliases: CVE-2022-3143 GHSA-jmj6-p2j9-68cp |
Wildfly-elytron possibly vulnerable to timing attacks via use of unsafe comparator wildfly-elytron: possible timing attacks via use of unsafe comparator. A flaw was found in Wildfly-elytron. Wildfly-elytron uses `java.util.Arrays.equals` in several places, which is unsafe and vulnerable to timing attacks. To compare values securely, use `java.security.MessageDigest.isEqual` instead. This flaw allows an attacker to access secure information or impersonate an authed user. |
Affected by 0 other vulnerabilities. Affected by 1 other vulnerability. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-7qwz-74p6-yqhs | Observable Discrepancy in Wildfly Elytron A flaw was found in Wildfly Elytron where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality. This flaw affectes Wildfly Elytron versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final. |
CVE-2021-3642
GHSA-5499-qjvh-6j7w |