Lucene search

Veracode Vulnerability DatabaseVERACODE:31510

HistoryAug 06, 2021 - 12:40 a.m.

Information Disclosure

2021-08-0600:40:43

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:N/A:N

JSON

wildfly-elytron is vulnerable to information disclosure. A timing attack allows an attacker to discover confidential information due to the usage of simple byte comparison to verify the message nonce and client proof.

CPENameOperatorVersion
wildfly elytronle1.10.13.Final
wildfly elytronle1.15.3.Final
wildfly elytronle1.16.0.Final
wildfly elytronle1.10.13.Final
wildfly elytronle1.15.3.Final
wildfly elytronle1.16.0.Final
eap7-jboss-remotingeq5.0.19__1.Final_redhat_00001.1.el8eap
eap7-jboss-remotingeq5.0.17__1.Final_redhat_00001.1.el8eap
eap7-jboss-remotingeq5.0.8__2.Final_redhat_1.1.el7eap
eap7-jboss-remotingeq5.0.18__1.Final_redhat_00001.1.el8eap

Name	Operator	Version
wildfly elytron	le	1.10.13.Final
wildfly elytron	le	1.15.3.Final
wildfly elytron	le	1.16.0.Final
wildfly elytron	le	1.10.13.Final
wildfly elytron	le	1.15.3.Final
wildfly elytron	le	1.16.0.Final
eap7-jboss-remoting	eq	5.0.19__1.Final_redhat_00001.1.el8eap
eap7-jboss-remoting	eq	5.0.17__1.Final_redhat_00001.1.el8eap
eap7-jboss-remoting	eq	5.0.8__2.Final_redhat_1.1.el7eap
eap7-jboss-remoting	eq	5.0.18__1.Final_redhat_00001.1.el8eap

Rows per page:

1-10 of 8221

References

bugzilla.redhat.com/show_bug.cgi?id=1981407

issues.redhat.com/browse/ELY-2147

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:N/A:N

JSON

Related for VERACODE:31510