CVE-2017-3156
HIGH
7.5
CVSS Severity Score
Vulnerability Description
The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks.
Affected Platforms (CPE)
📦
Apache
Cxf
<= 3.0.12📦
Apache
Cxf
= 3.1.0📦
Apache
Cxf
= 3.1.1📦
Apache
Cxf
= 3.1.2📦
Apache
Cxf
= 3.1.3📦
Apache
Cxf
= 3.1.4📦
Apache
Cxf
= 3.1.5📦
Apache
Cxf
= 3.1.6📦
Apache
Cxf
= 3.1.7📦
Apache
Cxf
= 3.1.8📦
Apache