CVE-2022-3143: High severity redhat WildFly Elytron vulnerability
A flaw was found in Wildfly-elytron. Wildfly-elytron uses java.util.Arrays.equals in several places, which is unsafe and vulnerable to timing attacks. To compare values securely, use java.security.MessageDigest.isEqual instead. This flaw allows an attacker to access secure information or impersonate an authed user.
Other sources
Wildfly-elytron uses java.util.Arrays.equals in several places, which is unsafe and vulnerable to timing attacks. java.security.MessageDigest.isEqual should be used instead to compare values securely. An attacker could possibly use this vulnerability to access secure information or impersonate an authed user.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/eap7-wildfly-elytronto a version that resolves this vulnerability.Fixed in 0:1.15.16-1.Final_redhat_00001.1.el8ea - Upgrade
Upgrade
redhat/eap7-wildfly-elytronto a version that resolves this vulnerability.Fixed in 0:1.15.16-1.Final_redhat_00001.1.el9ea - Upgrade
Upgrade
redhat/eap7-wildfly-elytronto a version that resolves this vulnerability.Fixed in 0:1.15.16-1.Final_redhat_00001.1.el7ea - Upgrade
Upgrade
redhat/wildfly-elytronto a version that resolves this vulnerability.Fixed in 1.15.15 - Upgrade
Upgrade
redhat/wildfly-elytronto a version that resolves this vulnerability.Fixed in 1.20.3
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-3143?
CVE-2022-3143 is a vulnerability found in Wildfly-elytron that allows for timing attacks via the use of unsafe comparator.
How can Wildfly-elytron be exploited?
Wildfly-elytron can be exploited through timing attacks using java.util.Arrays.equals.
Is there a fix available for Wildfly-elytron?
Yes, the recommended fix for Wildfly-elytron is to upgrade to version 1.15.15 or higher.
Where can I find more information about CVE-2022-3143?
You can find more information about CVE-2022-3143 in the Red Hat security advisory RHSA-2023:0553.
What is the severity of CVE-2022-3143?
The severity of CVE-2022-3143 is high with a CVSS score of 7.4.