Vulnerability-Lookup

CVE-2017-3156 (GCVE-0-2017-3156)

Vulnerability from cvelistv5 – Published: 2017-08-10 18:00 – Updated: 2024-09-16 23:16

Summary

The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks.

Severity

7.5 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

Timing attack

Assigner

apache CNA under the mitre root

CNA scorecard B 76/100 over 946 records in the last 180 days details

References

9 references

URL	Tags
http://www.securityfocus.com/bid/96398	vdb-entryx_refsource_BID
https://access.redhat.com/errata/RHSA-2017:1832	vendor-advisoryx_refsource_REDHAT
http://cxf.apache.org/security-advisories.data/CV…	x_refsource_CONFIRM
https://lists.apache.org/thread.html/rc7742781358…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r36e44ffc1a9…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rff42cfa5e7d…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rd49aabd984e…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rec7160382ba…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rfb87e0bf399…	mailing-listx_refsource_MLIST

Impacted products

1 product

Vendor	Product	Version	CPE status
Apache Software Foundation	Apache CXF	Affected: prior to 3.0.13 Affected: 3.1.x prior to 3.1.10	guessed

Date Public

2017-02-20 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T14:16:28.249Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "96398",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/96398"
          },
          {
            "name": "RHSA-2017:1832",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1832"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://cxf.apache.org/security-advisories.data/CVE-2017-3156.txt.asc"
          },
          {
            "name": "[cxf-commits] 20200116 svn commit: r1055336 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-12423.txt.asc security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E"
          },
          {
            "name": "[cxf-commits] 20200319 svn commit: r1058035 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E"
          },
          {
            "name": "[cxf-commits] 20200401 svn commit: r1058573 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2020-1954.txt.asc security-advisories.html",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E"
          },
          {
            "name": "[cxf-commits] 20201112 svn commit: r1067927 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2020-13954.txt.asc security-advisories.html",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E"
          },
          {
            "name": "[cxf-commits] 20210402 svn commit: r1073270 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2021-22696.txt.asc security-advisories.html",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E"
          },
          {
            "name": "[cxf-commits] 20210616 svn commit: r1075801 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2021-30468.txt.asc security-advisories.html",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache CXF",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 3.0.13"
            },
            {
              "status": "affected",
              "version": "3.1.x prior to 3.1.10"
            }
          ]
        }
      ],
      "datePublic": "2017-02-20T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Timing attack",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-06-16T11:07:19.000Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "name": "96398",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/96398"
        },
        {
          "name": "RHSA-2017:1832",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1832"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://cxf.apache.org/security-advisories.data/CVE-2017-3156.txt.asc"
        },
        {
          "name": "[cxf-commits] 20200116 svn commit: r1055336 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-12423.txt.asc security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E"
        },
        {
          "name": "[cxf-commits] 20200319 svn commit: r1058035 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E"
        },
        {
          "name": "[cxf-commits] 20200401 svn commit: r1058573 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2020-1954.txt.asc security-advisories.html",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E"
        },
        {
          "name": "[cxf-commits] 20201112 svn commit: r1067927 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2020-13954.txt.asc security-advisories.html",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E"
        },
        {
          "name": "[cxf-commits] 20210402 svn commit: r1073270 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2021-22696.txt.asc security-advisories.html",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E"
        },
        {
          "name": "[cxf-commits] 20210616 svn commit: r1075801 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2021-30468.txt.asc security-advisories.html",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "DATE_PUBLIC": "2017-02-20T00:00:00",
          "ID": "CVE-2017-3156",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache CXF",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "prior to 3.0.13"
                          },
                          {
                            "version_value": "3.1.x prior to 3.1.10"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Timing attack"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "96398",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/96398"
            },
            {
              "name": "RHSA-2017:1832",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1832"
            },
            {
              "name": "http://cxf.apache.org/security-advisories.data/CVE-2017-3156.txt.asc",
              "refsource": "CONFIRM",
              "url": "http://cxf.apache.org/security-advisories.data/CVE-2017-3156.txt.asc"
            },
            {
              "name": "[cxf-commits] 20200116 svn commit: r1055336 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-12423.txt.asc security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@%3Ccommits.cxf.apache.org%3E"
            },
            {
              "name": "[cxf-commits] 20200319 svn commit: r1058035 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E"
            },
            {
              "name": "[cxf-commits] 20200401 svn commit: r1058573 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2020-1954.txt.asc security-advisories.html",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E"
            },
            {
              "name": "[cxf-commits] 20201112 svn commit: r1067927 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2020-13954.txt.asc security-advisories.html",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E"
            },
            {
              "name": "[cxf-commits] 20210402 svn commit: r1073270 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2021-22696.txt.asc security-advisories.html",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4@%3Ccommits.cxf.apache.org%3E"
            },
            {
              "name": "[cxf-commits] 20210616 svn commit: r1075801 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2021-30468.txt.asc security-advisories.html",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e@%3Ccommits.cxf.apache.org%3E"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2017-3156",
    "datePublished": "2017-08-10T18:00:00.000Z",
    "dateReserved": "2016-12-05T00:00:00.000Z",
    "dateUpdated": "2024-09-16T23:16:01.996Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2017-3156",
      "date": "2026-10-17",
      "epss": "0.06315",
      "percentile": "0.93537"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "6BD90097-47AF-47E6-ABF9-80CFAAC71740",
                  "versionEndIncluding": "3.0.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:apache:cxf:3.1.0:*:*:*:*:*:*:*",
                  "matchCriteriaId": "BFBBD3B0-C8AE-45BA-83A3-847F03E90319",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:apache:cxf:3.1.1:*:*:*:*:*:*:*",
                  "matchCriteriaId": "52F66A01-83E5-48D8-AD1F-7F331CC889D3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:apache:cxf:3.1.2:*:*:*:*:*:*:*",
                  "matchCriteriaId": "2A1BF056-AA31-4968-85C7-9897F5720325",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:apache:cxf:3.1.3:*:*:*:*:*:*:*",
                  "matchCriteriaId": "EF05B313-65F0-4DD3-B6AC-0B4F6E39E677",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:apache:cxf:3.1.4:*:*:*:*:*:*:*",
                  "matchCriteriaId": "F0DA5338-6541-46CF-B8BC-BA41CF9C33CD",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:apache:cxf:3.1.5:*:*:*:*:*:*:*",
                  "matchCriteriaId": "132F95AB-FF48-4434-A5E7-4EC7C801FAC3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:apache:cxf:3.1.6:*:*:*:*:*:*:*",
                  "matchCriteriaId": "E74DDFC9-7DFB-4C60-B20D-274260481F1A",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:apache:cxf:3.1.7:*:*:*:*:*:*:*",
                  "matchCriteriaId": "B0029085-6E5C-4502-967B-8CA47FDE39EF",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:apache:cxf:3.1.8:*:*:*:*:*:*:*",
                  "matchCriteriaId": "69F2C5BA-4052-46F7-9AF4-BB87E7A8FFFC",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:apache:cxf:3.1.9:*:*:*:*:*:*:*",
                  "matchCriteriaId": "35153CBF-EBC4-4D83-86F1-E1AC867DE7ED",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks."
        },
        {
          "lang": "es",
          "value": "OAuth2 Hawk y JOSE MAC en Apache CXF en versiones anteriores a la 3.0.13 y en versiones 3.1.x anteriores a la 3.1.10 no emplean un algoritmo de comparaci\u00f3n de firma MAC de tiempo constante, lo que podr\u00eda ser explotado por ataques basados en tiempo sofisticados."
        }
      ],
      "id": "CVE-2017-3156",
      "lastModified": "2024-11-21T03:24:56.657",
      "metrics": {
        "cvssMetricV2": [
          {
            "acInsufInfo": false,
            "baseSeverity": "MEDIUM",
            "cvssData": {
              "accessComplexity": "LOW",
              "accessVector": "NETWORK",
              "authentication": "NONE",
              "availabilityImpact": "NONE",
              "baseScore": 5.0,
              "confidentialityImpact": "PARTIAL",
              "integrityImpact": "NONE",
              "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
              "version": "2.0"
            },
            "exploitabilityScore": 10.0,
            "impactScore": 2.9,
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "source": "nvd@nist.gov",
            "type": "Primary",
            "userInteractionRequired": false
          }
        ],
        "cvssMetricV30": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.0"
            },
            "exploitabilityScore": 3.9,
            "impactScore": 3.6,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2017-08-10T18:29:00.300",
      "references": [
        {
          "source": "security@apache.org",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "http://cxf.apache.org/security-advisories.data/CVE-2017-3156.txt.asc"
        },
        {
          "source": "security@apache.org",
          "tags": [
            "Third Party Advisory",
            "VDB Entry"
          ],
          "url": "http://www.securityfocus.com/bid/96398"
        },
        {
          "source": "security@apache.org",
          "url": "https://access.redhat.com/errata/RHSA-2017:1832"
        },
        {
          "source": "security@apache.org",
          "url": "https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E"
        },
        {
          "source": "security@apache.org",
          "url": "https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E"
        },
        {
          "source": "security@apache.org",
          "url": "https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E"
        },
        {
          "source": "security@apache.org",
          "url": "https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E"
        },
        {
          "source": "security@apache.org",
          "url": "https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E"
        },
        {
          "source": "security@apache.org",
          "url": "https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "http://cxf.apache.org/security-advisories.data/CVE-2017-3156.txt.asc"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Third Party Advisory",
            "VDB Entry"
          ],
          "url": "http://www.securityfocus.com/bid/96398"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://access.redhat.com/errata/RHSA-2017:1832"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E"
        }
      ],
      "sourceIdentifier": "security@apache.org",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "NVD-CWE-noinfo"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6BD90097-47AF-47E6-ABF9-80CFAAC71740",
                    "versionEndIncluding": "3.0.12",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:cxf:3.1.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BFBBD3B0-C8AE-45BA-83A3-847F03E90319",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:cxf:3.1.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "52F66A01-83E5-48D8-AD1F-7F331CC889D3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:cxf:3.1.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2A1BF056-AA31-4968-85C7-9897F5720325",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:cxf:3.1.3:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EF05B313-65F0-4DD3-B6AC-0B4F6E39E677",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:cxf:3.1.4:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F0DA5338-6541-46CF-B8BC-BA41CF9C33CD",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:cxf:3.1.5:*:*:*:*:*:*:*",
                    "matchCriteriaId": "132F95AB-FF48-4434-A5E7-4EC7C801FAC3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:cxf:3.1.6:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E74DDFC9-7DFB-4C60-B20D-274260481F1A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:cxf:3.1.7:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B0029085-6E5C-4502-967B-8CA47FDE39EF",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:cxf:3.1.8:*:*:*:*:*:*:*",
                    "matchCriteriaId": "69F2C5BA-4052-46F7-9AF4-BB87E7A8FFFC",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:cxf:3.1.9:*:*:*:*:*:*:*",
                    "matchCriteriaId": "35153CBF-EBC4-4D83-86F1-E1AC867DE7ED",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks."
          },
          {
            "lang": "es",
            "value": "OAuth2 Hawk y JOSE MAC en Apache CXF en versiones anteriores a la 3.0.13 y en versiones 3.1.x anteriores a la 3.1.10 no emplean un algoritmo de comparaci\u00f3n de firma MAC de tiempo constante, lo que podr\u00eda ser explotado por ataques basados en tiempo sofisticados."
          }
        ],
        "id": "CVE-2017-3156",
        "lastModified": "2026-05-13T00:24:29.033",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "NONE",
                "baseScore": 5.0,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "NONE",
                "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                "version": "2.0"
              },
              "exploitabilityScore": 10.0,
              "impactScore": 2.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV30": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.0"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2017-08-10T18:29:00.300",
        "references": [
          {
            "source": "security@apache.org",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://cxf.apache.org/security-advisories.data/CVE-2017-3156.txt.asc"
          },
          {
            "source": "security@apache.org",
            "tags": [
              "Third Party Advisory",
              "VDB Entry"
            ],
            "url": "http://www.securityfocus.com/bid/96398"
          },
          {
            "source": "security@apache.org",
            "url": "https://access.redhat.com/errata/RHSA-2017:1832"
          },
          {
            "source": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E"
          },
          {
            "source": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E"
          },
          {
            "source": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E"
          },
          {
            "source": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E"
          },
          {
            "source": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E"
          },
          {
            "source": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://cxf.apache.org/security-advisories.data/CVE-2017-3156.txt.asc"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory",
              "VDB Entry"
            ],
            "url": "http://www.securityfocus.com/bid/96398"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://access.redhat.com/errata/RHSA-2017:1832"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E"
          }
        ],
        "sourceIdentifier": "security@apache.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T21:56:28+00:00",
      "cve": "CVE-2017-3156",
      "id": "CVE-2017-3156",
      "initial_release_date": "2017-02-20T00:00:00+00:00",
      "product_status:fixed": "2",
      "product_status:known_affected": "5",
      "product_status:known_not_affected": "8",
      "product_status:under_investigation": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "cxf: CXF OAuth2 Hawk and JOSE MAC Validation code are vulnerable to timing attacks",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2017/cve-2017-3156.json",
      "version": "3"
    }
  }
}

CNVD-2017-02728

Vulnerability from cnvd - Published: 2017-03-15

Title

Apache CXF时序攻击信息泄露漏洞

Description

Apache CXF是美国阿帕奇（Apache）软件基金会的一个开源的Web服务框架。 Apache CXF OAuth2 Hawk和JOSE MAC验证代码存在时序攻击漏洞，允许远程攻击者可利用该漏洞提交特殊的请求获取敏感信息。

Severity

中

Patch Name

Apache CXF时序攻击信息泄露漏洞的补丁

Patch Description

Apache CXF是美国阿帕奇（Apache）软件基金会的一个开源的Web服务框架。 Apache CXF OAuth2 Hawk和JOSE MAC验证代码存在时序攻击漏洞，允许远程攻击者可利用该漏洞提交特殊的请求获取敏感信息。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://cxf.apache.org/security-advisories.data/CVE-2017-3156.txt.asc

Reference

http://www.securityfocus.com/bid/96398

Impacted products

Name
['Apache Software Foundation CXF 3.0.7', 'Apache Software Foundation CXF 3.0.6', 'Apache Software Foundation CXF 3.0.5', 'Apache Software Foundation CXF 3.0.4', 'Apache Software Foundation CXF 3.0.3', 'Apache Software Foundation CXF 3.0.2', 'Apache Software Foundation CXF 3.0.1']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "96398"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-3156"
    }
  },
  "description": "Apache CXF\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u8f6f\u4ef6\u57fa\u91d1\u4f1a\u7684\u4e00\u4e2a\u5f00\u6e90\u7684Web\u670d\u52a1\u6846\u67b6\u3002\r\n\r\nApache CXF OAuth2 Hawk\u548cJOSE MAC\u9a8c\u8bc1\u4ee3\u7801\u5b58\u5728\u65f6\u5e8f\u653b\u51fb\u6f0f\u6d1e\uff0c\u5141\u8bb8\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u63d0\u4ea4\u7279\u6b8a\u7684\u8bf7\u6c42\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002",
  "discovererName": "Richard Kettelerij",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://cxf.apache.org/security-advisories.data/CVE-2017-3156.txt.asc",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-02728",
  "openTime": "2017-03-15",
  "patchDescription": "Apache CXF\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u8f6f\u4ef6\u57fa\u91d1\u4f1a\u7684\u4e00\u4e2a\u5f00\u6e90\u7684Web\u670d\u52a1\u6846\u67b6\u3002\r\n\r\nApache CXF OAuth2 Hawk\u548cJOSE MAC\u9a8c\u8bc1\u4ee3\u7801\u5b58\u5728\u65f6\u5e8f\u653b\u51fb\u6f0f\u6d1e\uff0c\u5141\u8bb8\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u63d0\u4ea4\u7279\u6b8a\u7684\u8bf7\u6c42\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Apache CXF\u65f6\u5e8f\u653b\u51fb\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Apache Software Foundation CXF 3.0.7",
      "Apache Software Foundation CXF  3.0.6",
      "Apache Software Foundation CXF  3.0.5",
      "Apache Software Foundation CXF  3.0.4",
      "Apache Software Foundation CXF  3.0.3",
      "Apache Software Foundation CXF  3.0.2",
      "Apache Software Foundation CXF  3.0.1"
    ]
  },
  "referenceLink": "http://www.securityfocus.com/bid/96398",
  "serverity": "\u4e2d",
  "submitTime": "2017-03-02",
  "title": "Apache CXF\u65f6\u5e8f\u653b\u51fb\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e"
}

FKIE_CVE-2017-3156

Vulnerability from fkie_nvd - Published: 2017-08-10 18:29 - Updated: 2026-06-17 01:17

Severity

7.5 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

References

URL	Tags
security@apache.org	http://cxf.apache.org/security-advisories.data/CVE-2017-3156.txt.asc	Vendor Advisory
security@apache.org	http://www.securityfocus.com/bid/96398	Third Party Advisory, VDB Entry
security@apache.org	https://access.redhat.com/errata/RHSA-2017:1832
security@apache.org	https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E
security@apache.org	https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E
security@apache.org	https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E
security@apache.org	https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E
security@apache.org	https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E
security@apache.org	https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108	http://cxf.apache.org/security-advisories.data/CVE-2017-3156.txt.asc	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/96398	Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	https://access.redhat.com/errata/RHSA-2017:1832
af854a3a-2127-422b-91ae-364da2661108	https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108	https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108	https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108	https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108	https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108	https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E

Impacted products

Vendor	Product	Version
apache	cxf	*
apache	cxf	3.1.0
apache	cxf	3.1.1
apache	cxf	3.1.2
apache	cxf	3.1.3
apache	cxf	3.1.4
apache	cxf	3.1.5
apache	cxf	3.1.6
apache	cxf	3.1.7
apache	cxf	3.1.8
apache	cxf	3.1.9

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Apache CXF",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 3.0.13"
            },
            {
              "status": "affected",
              "version": "3.1.x prior to 3.1.10"
            }
          ]
        }
      ],
      "source": "security@apache.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6BD90097-47AF-47E6-ABF9-80CFAAC71740",
              "versionEndIncluding": "3.0.12",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cxf:3.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "BFBBD3B0-C8AE-45BA-83A3-847F03E90319",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cxf:3.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "52F66A01-83E5-48D8-AD1F-7F331CC889D3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cxf:3.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "2A1BF056-AA31-4968-85C7-9897F5720325",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cxf:3.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "EF05B313-65F0-4DD3-B6AC-0B4F6E39E677",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cxf:3.1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "F0DA5338-6541-46CF-B8BC-BA41CF9C33CD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cxf:3.1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "132F95AB-FF48-4434-A5E7-4EC7C801FAC3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cxf:3.1.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "E74DDFC9-7DFB-4C60-B20D-274260481F1A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cxf:3.1.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "B0029085-6E5C-4502-967B-8CA47FDE39EF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cxf:3.1.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "69F2C5BA-4052-46F7-9AF4-BB87E7A8FFFC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cxf:3.1.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "35153CBF-EBC4-4D83-86F1-E1AC867DE7ED",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks."
    },
    {
      "lang": "es",
      "value": "OAuth2 Hawk y JOSE MAC en Apache CXF en versiones anteriores a la 3.0.13 y en versiones 3.1.x anteriores a la 3.1.10 no emplean un algoritmo de comparaci\u00f3n de firma MAC de tiempo constante, lo que podr\u00eda ser explotado por ataques basados en tiempo sofisticados."
    }
  ],
  "id": "CVE-2017-3156",
  "lastModified": "2026-06-17T01:17:38.050",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2017-08-10T18:29:00.300",
  "references": [
    {
      "source": "security@apache.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://cxf.apache.org/security-advisories.data/CVE-2017-3156.txt.asc"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/96398"
    },
    {
      "source": "security@apache.org",
      "url": "https://access.redhat.com/errata/RHSA-2017:1832"
    },
    {
      "source": "security@apache.org",
      "url": "https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E"
    },
    {
      "source": "security@apache.org",
      "url": "https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E"
    },
    {
      "source": "security@apache.org",
      "url": "https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E"
    },
    {
      "source": "security@apache.org",
      "url": "https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E"
    },
    {
      "source": "security@apache.org",
      "url": "https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E"
    },
    {
      "source": "security@apache.org",
      "url": "https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://cxf.apache.org/security-advisories.data/CVE-2017-3156.txt.asc"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/96398"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://access.redhat.com/errata/RHSA-2017:1832"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E"
    }
  ],
  "sourceIdentifier": "security@apache.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-QC2P-Q7X9-V64P

Vulnerability from github – Published: 2022-05-13 01:09 – Updated: 2023-12-21 23:03

Summary

Covert Timing Channel in Apache CXF

Details

Severity

7.5 (High)


                  
                    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.0.12"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.cxf.karaf:apache-cxf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.0.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.1.9"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.cxf.karaf:apache-cxf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.1.0"
            },
            {
              "fixed": "3.1.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2017-3156"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-385"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-01T17:33:35Z",
    "nvd_published_at": "2017-08-10T18:29:00Z",
    "severity": "HIGH"
  },
  "details": "The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks.",
  "id": "GHSA-qc2p-q7x9-v64p",
  "modified": "2023-12-21T23:03:29Z",
  "published": "2022-05-13T01:09:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-3156"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/cxf/commit/1338469"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/cxf/commit/555843f"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2017:1832"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/cxf"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@%3Ccommits.cxf.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4@%3Ccommits.cxf.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e@%3Ccommits.cxf.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "http://cxf.apache.org/security-advisories.data/CVE-2017-3156.txt.asc"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Covert Timing Channel in Apache CXF"
}

GSD-2017-3156

Vulnerability from gsd - Updated: 2023-12-13 01:21

Details

Aliases

CVE-2017-3156

Aliases

CVE-2017-3156

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2017-3156",
    "description": "The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks.",
    "id": "GSD-2017-3156",
    "references": [
      "https://access.redhat.com/errata/RHSA-2017:1832"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2017-3156"
      ],
      "details": "The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks.",
      "id": "GSD-2017-3156",
      "modified": "2023-12-13T01:21:16.712789Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@apache.org",
        "DATE_PUBLIC": "2017-02-20T00:00:00",
        "ID": "CVE-2017-3156",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Apache CXF",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "prior to 3.0.13"
                        },
                        {
                          "version_value": "3.1.x prior to 3.1.10"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Apache Software Foundation"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Timing attack"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "96398",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/96398"
          },
          {
            "name": "RHSA-2017:1832",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2017:1832"
          },
          {
            "name": "http://cxf.apache.org/security-advisories.data/CVE-2017-3156.txt.asc",
            "refsource": "CONFIRM",
            "url": "http://cxf.apache.org/security-advisories.data/CVE-2017-3156.txt.asc"
          },
          {
            "name": "[cxf-commits] 20200116 svn commit: r1055336 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-12423.txt.asc security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@%3Ccommits.cxf.apache.org%3E"
          },
          {
            "name": "[cxf-commits] 20200319 svn commit: r1058035 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E"
          },
          {
            "name": "[cxf-commits] 20200401 svn commit: r1058573 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2020-1954.txt.asc security-advisories.html",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E"
          },
          {
            "name": "[cxf-commits] 20201112 svn commit: r1067927 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2020-13954.txt.asc security-advisories.html",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E"
          },
          {
            "name": "[cxf-commits] 20210402 svn commit: r1073270 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2021-22696.txt.asc security-advisories.html",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4@%3Ccommits.cxf.apache.org%3E"
          },
          {
            "name": "[cxf-commits] 20210616 svn commit: r1075801 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2021-30468.txt.asc security-advisories.html",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e@%3Ccommits.cxf.apache.org%3E"
          }
        ]
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "(,3.0.12],[3.1.0,3.1.9]",
          "affected_versions": "All versions up to 3.0.12, all versions starting from 3.1.0 up to 3.1.9",
          "cvss_v2": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "cvss_v3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2022-07-01",
          "description": "The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks.",
          "fixed_versions": [
            "3.0.13",
            "3.1.10"
          ],
          "identifier": "CVE-2017-3156",
          "identifiers": [
            "GHSA-qc2p-q7x9-v64p",
            "CVE-2017-3156"
          ],
          "not_impacted": "All versions after 3.0.12 before 3.1.0, all versions after 3.1.9",
          "package_slug": "maven/org.apache.cxf.karaf/apache-cxf",
          "pubdate": "2022-05-13",
          "solution": "Upgrade to versions 3.0.13, 3.1.10 or above.",
          "title": "Covert Timing Channel in Apache CXF",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2017-3156",
            "https://access.redhat.com/errata/RHSA-2017:1832",
            "https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E",
            "https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@%3Ccommits.cxf.apache.org%3E",
            "https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E",
            "https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4@%3Ccommits.cxf.apache.org%3E",
            "https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e@%3Ccommits.cxf.apache.org%3E",
            "https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E",
            "http://cxf.apache.org/security-advisories.data/CVE-2017-3156.txt.asc",
            "https://github.com/advisories/GHSA-qc2p-q7x9-v64p"
          ],
          "uuid": "58fdcb42-b6a2-48fb-840c-42d6cac99ff1"
        },
        {
          "affected_range": "(,3.0.12],[3.1.0,3.1.9]",
          "affected_versions": "All versions up to 3.0.12, all versions starting from 3.1.0 up to 3.1.9",
          "cvss_v2": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "cvss_v3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2019-10-03",
          "description": "The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks.",
          "fixed_versions": [
            "3.0.13",
            "3.1.10"
          ],
          "identifier": "CVE-2017-3156",
          "identifiers": [
            "CVE-2017-3156"
          ],
          "not_impacted": "All versions after 3.0.12 before 3.1.0, all versions after 3.1.9",
          "package_slug": "maven/org.apache.cxf/cxf-rt-rs-security-jose",
          "pubdate": "2017-08-10",
          "solution": "Upgrade to versions 3.0.13, 3.1.10 or above.",
          "title": "Information Exposure Through Timing Discrepancy",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2017-3156",
            "http://cxf.apache.org/security-advisories.data/CVE-2017-3156.txt.asc",
            "http://www.securityfocus.com/bid/96398"
          ],
          "uuid": "473b601e-df5f-4fc6-8df7-edcb8e640b10"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:apache:cxf:3.1.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:cxf:3.1.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:cxf:3.1.8:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:cxf:3.1.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:cxf:3.1.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:cxf:3.1.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:cxf:3.1.7:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:cxf:3.1.9:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:cxf:3.1.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:cxf:3.1.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "3.0.12",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2017-3156"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-noinfo"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://cxf.apache.org/security-advisories.data/CVE-2017-3156.txt.asc",
              "refsource": "CONFIRM",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://cxf.apache.org/security-advisories.data/CVE-2017-3156.txt.asc"
            },
            {
              "name": "96398",
              "refsource": "BID",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://www.securityfocus.com/bid/96398"
            },
            {
              "name": "RHSA-2017:1832",
              "refsource": "REDHAT",
              "tags": [],
              "url": "https://access.redhat.com/errata/RHSA-2017:1832"
            },
            {
              "name": "[cxf-commits] 20200116 svn commit: r1055336 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-12423.txt.asc security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@%3Ccommits.cxf.apache.org%3E"
            },
            {
              "name": "[cxf-commits] 20200319 svn commit: r1058035 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E"
            },
            {
              "name": "[cxf-commits] 20200401 svn commit: r1058573 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2020-1954.txt.asc security-advisories.html",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E"
            },
            {
              "name": "[cxf-commits] 20201112 svn commit: r1067927 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2020-13954.txt.asc security-advisories.html",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E"
            },
            {
              "name": "[cxf-commits] 20210402 svn commit: r1073270 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2021-22696.txt.asc security-advisories.html",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4@%3Ccommits.cxf.apache.org%3E"
            },
            {
              "name": "[cxf-commits] 20210616 svn commit: r1075801 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2021-30468.txt.asc security-advisories.html",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e@%3Ccommits.cxf.apache.org%3E"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2021-06-16T12:15Z",
      "publishedDate": "2017-08-10T18:29Z"
    }
  }
}

RHSA-2017:1832

Vulnerability from csaf_redhat - Published: 2017-08-10 23:03 - Updated: 2026-08-04 21:54

Summary

Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.3 R4 security and bug fix update

Severity

Important

Scope

11 vulnerabilities in this advisory, including CVE-2017-3156.

CVE-2017-3156

It was found that Apache CXF OAuth2 Hawk and JOSE MAC Validation code is not using a constant time MAC signature comparison algorithm which may be exploited by some sophisticated timing attacks. It may only affect OAuth2 Hawk or JWT access tokens or JOSE JWS/JWE interceptors which depend on HMAC secret key algorithms.

5.3 (Medium)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Fixed: 2 products

https://access.redhat.com/errata/RHSA-2017:1832

Open the full advisory

RHSA-2017_1832

Vulnerability from csaf_redhat - Published: 2017-08-10 23:03 - Updated: 2024-11-22 11:10

Summary

Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.3 R4 security and bug fix update

Severity

Important

Scope

11 vulnerabilities in this advisory, including CVE-2017-3156.

CVE-2017-3156

5.3 (Medium)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Fixed: 2 products

https://access.redhat.com/errata/RHSA-2017:1832

Open the full advisory

WID-SEC-W-2026-0180

Vulnerability from csaf_certbund - Published: 2026-01-20 23:00 - Updated: 2026-01-20 23:00

Summary

Dell Data Protection Advisor: Mehrere Schwachstellen

Severity

Hoch

Scope

378 vulnerabilities in this advisory, including CVE-2017-3156.

CVE-2017-3156

Known affected: 1 product

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2017-3156 (GCVE-0-2017-3156)

CNVD-2017-02728

FKIE_CVE-2017-3156

GHSA-QC2P-Q7X9-V64P

GSD-2017-3156

RHSA-2017:1832

RHSA-2017_1832

WID-SEC-W-2026-0180

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour