Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.4
CVE-2022-3143: Wildfly-elytron: Unsecured User Data Exposure via Timing Attack
CVE-2022-3143 · published 3 years ago
Summary
The Wildfly-elytron software contains a security issue that could allow an attacker to access sensitive user information or impersonate authorized users. This is because the software uses an insecure method to compare data, making it vulnerable to a timing attack. To fix this, users should update to a version that uses a secure comparison method.
What to do
- Update wildfly org.wildfly.security:wildfly-elytron to version 1.15.15.Final.
- Update wildfly org.wildfly.security:wildfly-elytron to version 1.20.3.Final.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | wildfly | org.wildfly.security:wildfly-elytron |
< 1.15.15.Final >= 1.16.0.CR1, < 1.20.3.Final Fix: upgrade to 1.15.15.Final
|
| – | redhat | wildfly_elytron |
1.15.15 cpe:2.3:a:redhat:wildfly_elytron:1.15.15:*:*:*:*:*:*:* |
| – | redhat | jboss_enterprise_application_platform |
7.0.0 cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:* |
Original advisory text
wildfly-elytron: possible timing attacks via use of unsafe comparator. A flaw was found in Wildfly-elytron. Wildfly-elytron uses java.util.Arrays.equals in several places, which is unsafe and vulne...
wildfly-elytron: possible timing attacks via use of unsafe comparator. A flaw was found in Wildfly-elytron. Wildfly-elytron uses java.util.Arrays.equals in several places, which is unsafe and vulnerable to timing attacks. To compare values securely, use java.security.MessageDigest.isEqual instead. This flaw allows an attacker to access secure information or impersonate an authed user.
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2124682
- https://github.com/advisories/GHSA-jmj6-p2j9-68cp
- https://access.redhat.com/security/cve/CVE-2022-3143 URL
- https://nvd.nist.gov/vuln/detail/CVE-2022-3143 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3143.j... Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-203Observable Discrepancy
CWE-208Observable Timing Discrepancy
Timeline
Published11 Jan 2023
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta