PT-2017-15692
CVE-2017-3156
·
تاريخ النشر
2017-08-10
·
تاريخ التحديث
2022-05-13
الوصف من
CVSS 3.1
7.5
عاليةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
Apache CXF versions prior to 3.0.13
Apache CXF versions 3.1.x prior to 3.1.10
Description
The issue concerns the OAuth2 Hawk and JOSE MAC Validation code, which does not utilize a constant time MAC signature comparison algorithm. This could potentially be exploited by sophisticated timing attacks.
Recommendations
For Apache CXF versions prior to 3.0.13, update to version 3.0.13 or later.
For Apache CXF versions 3.1.x prior to 3.1.10, update to version 3.1.10 or later.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾