The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks.

Affected: Maven: org.apache.cxf.karaf:apache-cxf

The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks.

bouncycastle: Information disclosure in GCMBlockCipher camel-jacksonxml: Unmarshalling operation are vulnerable to RCE Security: Improper handling of path parameters allows bypassing the security constraint hawtio: Proxy is sharing cookies among all the clients hawtio: information Disclosure flaws due to unsafe path traversal cxf: CXF OAuth2 Hawk and JOSE MAC Validation code are vulnerable to timing attacks camel-core: Validation component vulnerable to SSRF via remote DTDs and XXE cxf: CXF JAX-RS XML Security streaming clients do not validate that the service response was signed or encrypted cxf: CXF's STSClient uses a flawed way of caching tokens that are associated with delegation tokens logback: Serialization vulnerability in SocketServer and ServerSocketReceiver XStream: DoS when unmarshalling void type

Ein Angreifer kann mehrere Schwachstellen in Dell Data Protection Advisor ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu erzeugen, Sicherheitsmaßnahmen zu umgehen und nicht näher spezifizierte Angriffe zu starten.