MEDIUM5.3
GHSA-5499-qjvh-6j7w
Observable Discrepancy in Wildfly Elytron
Quick fix
GHSA-5499-qjvh-6j7w — org.wildfly.security:wildfly-elytron: upgrade to the fixed version with the command below.
# pom.xml: bump <version>1.10.14</version> for org.wildfly.security:wildfly-elytronDetails
A flaw was found in Wildfly Elytron where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality. This flaw affectes Wildfly Elytron versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final.
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven/org.wildfly.security:wildfly-elytron
Introduced in:
0Fixed in: 1.10.14Fix
# pom.xml: bump <version>1.10.14</version> for org.wildfly.security:wildfly-elytronMaven/org.wildfly.security:wildfly-elytron
Introduced in:
1.11.0Fixed in: 1.15.5Fix
# pom.xml: bump <version>1.15.5</version> for org.wildfly.security:wildfly-elytronMaven/org.wildfly.security:wildfly-elytron
Introduced in:
1.16.0Fixed in: 1.16.1Fix
# pom.xml: bump <version>1.16.1</version> for org.wildfly.security:wildfly-elytron