GitHub Advisoryadvisory · Maven

GHSA-wfcc-pff6-rgc5 Jetty vulnerable to exposure of sensitive information due to observable discrepancy

HIGH Published 2018-10-19 Modified 2023-08-15 Official page ↗
Aliases
CVE-2017-9735
Ecosystem
Maven
Packages
org.eclipse.jetty:jetty-server
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200, CWE-203
Reviewed
2020-06-16

Affected packages

• Maven org.eclipse.jetty:jetty-server: >= 9.4.0, < 9.4.6.v20170531 → fixed in 9.4.6.v20170531 • Maven org.eclipse.jetty:jetty-server: >= 9.3.0, < 9.3.20.v20170531 → fixed in 9.3.20.v20170531 • Maven org.eclipse.jetty:jetty-server: < 9.2.22.v20170606 → fixed in 9.2.22.v20170606

Description

Jetty through 9.4.x contains a timing channel attack in `util/security/Password.java`, which allows attackers to obtain access by observing elapsed times before rejection of incorrect passwords.

Related

Alias · CVE (1)

  • CVE-2017-9735 Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain… vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-203 Observable Discrepancy weakness

References