GitStock

eclipse/jetty.project · Security

Jetty vulnerable to exposure of sensitive information due to observable discrepancy

GHSA ID
GHSA-wfcc-pff6-rgc5
CVE ID
CVE-2017-9735
Severity
high
Published
Updated
CVSS
7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v3
7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

Jetty through 9.4.x contains a timing channel attack in util/security/Password.java, which allows attackers to obtain access by observing elapsed times before rejection of incorrect passwords.

CWEs

  • CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-203 · Observable Discrepancy

References