Skip to content
OpenAdvisories
High · 7.4 CVE-2022-3143 EUVD-2023-0497GHSA-jmj6-p2j9-68cp

Wildfly-elytron possibly vulnerable to timing attacks via use of unsafe comparator

Published Jan 11, 2023 · Updated Apr 9, 2025 · Assigned by redhat

Vendor: redhat.com Product: Wildfly-elytron Package: org.wildfly.security:wildfly-elytron Ecosystem: Maven

Description

wildfly-elytron: possible timing attacks via use of unsafe comparator. A flaw was found in Wildfly-elytron. Wildfly-elytron uses java.util.Arrays.equals in several places, which is unsafe and vulnerable to timing attacks. To compare values securely, use java.security.MessageDigest.isEqual instead. This flaw allows an attacker to access secure information or impersonate an authed user.

Affected products

VendorProductAffectedFixed
redhat.com Wildfly-elytron 1.15.15 – < 1.15.15 1.15.15

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-glassfish-el +1 3.0.1-4.b08_redhat_00005.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-hibernate +5 5.1.17-3.Final_redhat_00004.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jackson-core +4 2.10.4-3.redhat_00006.1.el7eap RHSA-2025:9583
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jackson-databind 2.8.11.6-3.SP1_redhat_00003.1.ep7.el7 RHSA-2025:9583, RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jackson-datatype-jdk8 +2 2.10.4-2.redhat_00006.1.el7eap RHSA-2025:9583
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jackson-modules-base +1 2.10.4-5.redhat_00006.1.el7eap RHSA-2025:9583
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jboss-ejb-client 4.0.12-1.Final_redhat_00002.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jboss-server-migration +21 1.7.2-16.Final_redhat_00017.1.el7eap RHSA-2025:9583
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-netty +1 4.1.63-2.Final_redhat_00003.1.ep7.el7 RHSA-2025:9583, RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-undertow 1.4.18-16.SP14_redhat_00001.1.ep7.el7 RHSA-2025:9583, RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly +1 7.1.11-4.GA_redhat_00002.1.ep7.el7 RHSA-2025:9583, RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly-elytron 1.1.14-1.Final_redhat_00001.1.ep7.el7 RHSA-2025:9583, RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly-elytron-tool 1.10.17-1.Final_redhat_00001.1.el7eap RHSA-2025:9583
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly-http-client +4 1.0.21-1.Final_redhat_00001.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly-javadocs +2 7.3.14-3.GA_redhat_00002.1.el7eap RHSA-2025:9583
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly-naming-client 1.0.13-1.Final_redhat_00001.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly-openssl +1 1.0.12-1.Final_redhat_00001.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly-openssl-linux 1.0.12-6.Final_redhat_00001.1.ep7.el7 RHSA-2025:9582
Red Hat JBoss EAP 7 eap7-apache-sshd 2.9.2-1.redhat_00001.1.el7eap RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552
Red Hat JBoss EAP 7 eap7-elytron-web +1 1.9.3-1.Final_redhat_00001.1.el7eap RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552
Red Hat JBoss EAP 7 eap7-hal-console 3.3.16-1.Final_redhat_00001.1.el7eap RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552
Red Hat JBoss EAP 7 eap7-hibernate-search +5 5.10.13-3.Final_redhat_00001.1.el7eap RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552
Red Hat JBoss EAP 7 eap7-ironjacamar +8 1.5.10-1.Final_redhat_00001.1.el7eap RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552
Red Hat JBoss EAP 7 eap7-jackson-core +10 2.12.7-1.redhat_00003.1.el7eap RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552
Red Hat JBoss EAP 7 eap7-javaee-security-soteria +1 1.0.1-3.redhat_00003.1.el7eap RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552
Red Hat JBoss EAP 7 eap7-jboss-ejb-client 4.0.49-1.Final_redhat_00001.1.el7eap RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552
Red Hat JBoss EAP 7 eap7-jboss-jsf-api_2.3_spec 3.0.0-6.SP07_redhat_00001.1.el7eap RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552
Red Hat JBoss EAP 7 eap7-jboss-jsp-api_2.3_spec 2.0.0-3.Final_redhat_00001.1.el7eap RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552
Red Hat JBoss EAP 7 eap7-jboss-remoting 5.0.27-1.Final_redhat_00001.1.el7eap RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552
Red Hat JBoss EAP 7 eap7-jboss-server-migration +2 1.10.0-24.Final_redhat_00023.1.el7eap RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552
Red Hat JBoss EAP 7 eap7-jettison 1.5.2-1.redhat_00002.1.el7eap RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552
Red Hat JBoss EAP 7 eap7-undertow 2.2.22-1.SP3_redhat_00001.1.el7eap RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552
Red Hat JBoss EAP 7 eap7-wildfly +4 7.4.9-4.GA_redhat_00003.1.el7eap RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552
Red Hat JBoss EAP 7 eap7-wildfly-elytron +1 1.15.16-1.Final_redhat_00001.1.el7eap RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552
Red Hat JBoss EAP 7 eap7-woodstox-core 6.4.0-1.redhat_00001.1.el7eap RHSA-2023:0554, RHSA-2023:0553, RHSA-2023:0552

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.wildfly.security:wildfly-elytron < 1.15.15.Final 1.15.15.Final GHSA-jmj6-p2j9-68cp
Maven org.wildfly.security:wildfly-elytron >= 1.16.0.CR1, < 1.20.3.Final 1.20.3.Final GHSA-jmj6-p2j9-68cp

Advisories 6

References