Search for packages
| purl | pkg:maven/org.wildfly.security/wildfly-elytron@1.3.0.Final |
| Next non-vulnerable version | 1.15.15.Final |
| Latest non-vulnerable version | 2.6.2.Final |
| Risk | 4.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-6ssa-j1q1-c3cs
Aliases: CVE-2022-3143 GHSA-jmj6-p2j9-68cp |
Wildfly-elytron possibly vulnerable to timing attacks via use of unsafe comparator wildfly-elytron: possible timing attacks via use of unsafe comparator. A flaw was found in Wildfly-elytron. Wildfly-elytron uses `java.util.Arrays.equals` in several places, which is unsafe and vulnerable to timing attacks. To compare values securely, use `java.security.MessageDigest.isEqual` instead. This flaw allows an attacker to access secure information or impersonate an authed user. |
Affected by 0 other vulnerabilities. Affected by 1 other vulnerability. |
|
VCID-7qwz-74p6-yqhs
Aliases: CVE-2021-3642 GHSA-5499-qjvh-6j7w |
Observable Discrepancy in Wildfly Elytron A flaw was found in Wildfly Elytron where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality. This flaw affectes Wildfly Elytron versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final. |
Affected by 0 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 1 other vulnerability. Affected by 1 other vulnerability. Affected by 0 other vulnerabilities. |
|
VCID-99vp-bk8n-q3cp
Aliases: CVE-2020-10714 GHSA-7fhr-2694-rg79 |
Session Fixation A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. |
Affected by 0 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-bznx-gnst-3qgd
Aliases: CVE-2020-1748 GHSA-qgrq-cx4c-2rmm |
Incorrect Authorization in WildFly Elytron A flaw was found in all supported versions before wildfly-elytron-1.6.8.Final-redhat-00001, where the WildFlySecurityManager checks were bypassed when using custom security managers, resulting in an improper authorization. This flaw leads to information exposure by unauthenticated access to secure resources. |
Affected by 3 other vulnerabilities. Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||