PT-2017-15692 · Apache · Apache Cxf

Richard Kettelerij · Publicado 2017-08-10 · Atualizado 2022-05-13 · CVE-2017-3156

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 3.0.13 Apache CXF versions 3.1.x prior to 3.1.10

Description The issue concerns the OAuth2 Hawk and JOSE MAC Validation code, which does not utilize a constant time MAC signature comparison algorithm. This could potentially be exploited by sophisticated timing attacks.

Recommendations For Apache CXF versions prior to 3.0.13, update to version 3.0.13 or later. For Apache CXF versions 3.1.x prior to 3.1.10, update to version 3.1.10 or later.

Correção

Enumeração de Fraquezas

CWE-385

Identificadores relacionados

CVE-2017-3156

GHSA-QC2P-Q7X9-V64P

Produtos afetados

Apache Cxf

Referências · 21

• https://github.com/apache/cxf · Nota
• https://github.com/apache/cxf/commit/1338469 · Nota
• https://github.com/apache/cxf/commit/555843f · Nota
• https://osv.dev/vulnerability/GHSA-qc2p-q7x9-v64p · Aviso do Fabricante
• https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E · Nota
• https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E · Nota
• https://access.redhat.com/errata/RHSA-2017:1832 · Aviso do Fabricante
• http://cxf.apache.org/security-advisories.data/CVE-2017-3156.txt.asc · Aviso do Fabricante
• https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E · Nota
• https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-3156 · Nota de Segurança
• https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E · Nota
• https://osv.dev/vulnerability/CVE-2017-3156 · Aviso do Fabricante
• https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@%3Ccommits.cxf.apache.org%3E · Nota
• https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E · Nota