CVE-2017-3156: Information Exposure Through Timing Discrepancy

August 10, 2017 (updated October 3, 2019)

The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks.

References

cxf.apache.org/security-advisories.data/CVE-2017-3156.txt.asc
www.securityfocus.com/bid/96398
nvd.nist.gov/vuln/detail/CVE-2017-3156

Code Behaviors & Features

Detect and mitigate CVE-2017-3156 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →