Covert Timing Channel in Apache CXF

The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks...

PT-2017-15692

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 3.0.13 Apache CXF versions 3.1.x prior to 3.1.10 Description The issue concerns the OAuth2 Hawk and JOSE MAC Validation code, which does not utilize a constant time MAC signature comparison algorithm. This could...

CVE-2017-3156: Undefined Security Weakness

The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks...

Timing Attacks

Apache CXF is susceptible to timing attacks. The vulnerability is possible because MAC signature comparison algorithm used by its OAuth2 Hawk and JOSE MAC Validation code is not performed in constant time. Therefore, an attacker can trigger a timing attack through the OAuth2 Hawk or JWT access...