CVE-2017-3156 Covert Timing Channel in Apache CXF
Attackers can exploit timing side-channels in OAuth2 MAC validation to bypass authentication checks in Apache CXF.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-3156?
CVE-2017-3156 is a high-severity vulnerability in Apache Cxf, published on 10 Aug 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks.
Which versions are affected by CVE-2017-3156?
4 open source packages ship an affected version, including org.apache.cxf.karaf:apache-cxf. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.cxf.karaf:apache-cxf Maven | All versions | 3.0.13 |
org.apache.cxf.karaf:apache-cxf Maven | All versions | 3.0.13 |
org.apache.cxf.karaf:apache-cxf Maven | From 3.1.0 | 3.1.10 |
org.apache.cxf.karaf:apache-cxf Maven | From 3.1.0 | 3.1.10 |
Products include Apache Cxf.
How do I fix CVE-2017-3156?
Upgrade org.apache.cxf.karaf:apache-cxf to a fixed version for your release line: 3.0.13 or 3.1.10.
Is CVE-2017-3156 being exploited?
There is no known exploitation of CVE-2017-3156 in the wild and no public exploit code.
Other vulnerabilities in Apache Cxf
- CVE-2012-2379 XML Signature/Encryption Not Validated in Apache CXF
- CVE-2026-66909 Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage
- CVE-2026-68079 Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
- CVE-2026-50628 Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
- CVE-2025-48913 Apache CXF: Untrusted JMS configuration can lead to RCE
Sources
Also known as GHSA-qc2p-q7x9-v64p.