CVE-2017-3156
Covert Timing Channel in Apache CXF
CVE-2017-3156 is a high vulnerability (CVSS 7.5) in Apache Cxf, published August 10, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.31%, the 93rd percentile. Fixed in org.apache.cxf.karaf:apache-cxf 3.0.13.
- Severity
- 7.5 HighCVSS 3.0, NVD
- Exploit chance
- 6.31%EPSS, 93rd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.0.13org.apache.cxf.karaf:apache-cxf +3 more
Description
The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.cxf.karaf:apache-cxfMaven | through 3.0.12 | 3.0.13 |
org.apache.cxf.karaf:apache-cxfMaven | 3.1.0 to 3.1.9 | 3.1.10 |
org.apache.cxf.karaf:apache-cxfMaven | before 3.0.13, plus listed versions 2.3.102.3.112.3.32.3.42.3.5 Show 45 moreShow less2.3.62.3.72.3.82.3.92.4.02.4.12.4.102.4.22.4.32.4.42.4.52.4.62.4.72.4.82.4.92.5.02.5.12.5.102.5.112.5.22.5.32.5.42.5.52.5.5.12.5.62.5.72.5.82.5.92.6.02.6.12.6.102.6.112.6.122.6.132.6.142.6.152.6.162.6.172.6.22.6.32.6.42.6.52.6.62.6.6.12.6.7 | 3.0.13 |
org.apache.cxf.karaf:apache-cxfMaven | 3.1.0 up to 3.1.10, plus listed versions 3.1.13.1.23.1.33.1.43.1.5 Show 4 moreShow less3.1.63.1.73.1.83.1.9 | 3.1.10 |
What each source reports
NVD Score used
The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks.
- Record
CVE-2017-3156- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE ListNo score
The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks.
- Record
CVE-2017-3156- Updated
- 2026-11-02
EUVDEUVD-2022-4941No score
The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks.
- Record
EUVD-2022-4941- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qc2p-q7x9-v64p
Covert Timing Channel in Apache CXF
The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks.
- Record
GHSA-qc2p-q7x9-v64p- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-385
- Updated
- 2026-11-02
OSV
The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks.
- Record
CVE-2017-3156- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-qc2p-q7x9-v64p
Covert Timing Channel in Apache CXF
The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks.
- Record
GHSA-qc2p-q7x9-v64p- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-385
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
securityfocus.com/bid/96398
access.redhat.com/errata/RHSA-2017:1832
cxf.apache.org/security-advisories.data/CVE-2017-3156.txt.asc
lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E
Show 14 moreShow less
nvd.nist.gov/vuln/detail/CVE-2017-3156
github.com/apache/cxf/commit/1338469
Left out here: 36 versions. The JSON record has them.