GHSA-5499-qjvh-6j7w
Observable Discrepancy in Wildfly Elytron
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.wildfly.security:wildfly-elytron | < 1.10.14 | 1.10.14 |
| Maven | org.wildfly.security:wildfly-elytron | >= 1.11.0, < 1.15.5 | 1.15.5 |
| Maven | org.wildfly.security:wildfly-elytron | >= 1.16.0, < 1.16.1 | 1.16.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
A flaw was found in Wildfly Elytron where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality. This flaw affectes Wildfly Elytron versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final.
References
External links from the advisory. They lead to third-party sites.