CVE-2022-3143
First published: Tue Sep 06 2022(Updated: )
wildfly-elytron: possible timing attacks via use of unsafe comparator. A flaw was found in Wildfly-elytron. Wildfly-elytron uses java.util.Arrays.equals in several places, which is unsafe and vulnerable to timing attacks. To compare values securely, use java.security.MessageDigest.isEqual instead. This flaw allows an attacker to access secure information or impersonate an authed user.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/wildfly-elytron | <1.15.15 | 1.15.15 |
| redhat/wildfly-elytron | <1.20.3 | 1.20.3 |
| redhat/eap7-wildfly-elytron | <0:1.15.16-1.Final_redhat_00001.1.el8ea | 0:1.15.16-1.Final_redhat_00001.1.el8ea |
| redhat/eap7-wildfly-elytron | <0:1.15.16-1.Final_redhat_00001.1.el9ea | 0:1.15.16-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-wildfly-elytron | <0:1.15.16-1.Final_redhat_00001.1.el7ea | 0:1.15.16-1.Final_redhat_00001.1.el7ea |
| Redhat Wildfly Elytron | =1.15.15 | |
| Redhat Jboss Enterprise Application Platform | =7.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/security/cve/CVE-2022-3143
- https://access.redhat.com/errata/RHSA-2023:0553
- https://access.redhat.com/errata/RHSA-2023:0552
- https://access.redhat.com/errata/RHSA-2023:0554
- https://access.redhat.com/errata/RHSA-2023:0556
- https://access.redhat.com/security/cve/cve-2022-3143
- https://bugzilla.redhat.com/show_bug.cgi?id=2124682
- https://www.cve.org/CVERecord?id=CVE-2022-3143 https://nvd.nist.gov/vuln/detail/CVE-2022-3143
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is CVE-2022-3143?
CVE-2022-3143 is a vulnerability found in Wildfly-elytron that allows for timing attacks via the use of unsafe comparator.
How can Wildfly-elytron be exploited?
Wildfly-elytron can be exploited through timing attacks using java.util.Arrays.equals.
Is there a fix available for Wildfly-elytron?
Yes, the recommended fix for Wildfly-elytron is to upgrade to version 1.15.15 or higher.
Where can I find more information about CVE-2022-3143?
You can find more information about CVE-2022-3143 in the Red Hat security advisory RHSA-2023:0553.
What is the severity of CVE-2022-3143?
The severity of CVE-2022-3143 is high with a CVSS score of 7.4.
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/nvd-index
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-3143
- agent/software-canonical-lookup
- collector/redhat-cve
- vendor/redhat
- canonical/redhat wildfly elytron
- version/redhat wildfly elytron/1.15.15
- canonical/redhat jboss enterprise application platform
- version/redhat jboss enterprise application platform/7.0.0
- package-manager/redhat