Skip to main content

Observable Discrepancy

CVE-2022-3143

High
7.4/10

Summary

A flaw was found in Wildfly-elytron versions through 1.15.14.Final and 1.16.0.CR1 through 1.20.2.Final and 2.0.0.Alpha1 through 2.0.0.Alpha10, possible timing attacks via use of an unsafe comparator. Wildfly-elytron uses "java.util.Arrays.equals" in several places, which is unsafe and vulnerable to timing attacks. To compare values securely, use "java.security.MessageDigest.isEqual" instead. This flaw allows an attacker to access secure information or impersonate an authed user.

  • HIGH
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • NONE

CWE-203 - Observable Discrepancy

The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

References

Advisory Timeline

  • Published