NetSight
IP …
high7.5

CVE-2017-9735

Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elaps…

Impact

Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.

Affected products

VendorProductAffected versions
EclipseJetty
before 9.2.22
from 9.3.0 before 9.3.20
from 9.4.0 before 9.4.6
DebianDebian Linux
Version 9.0
OracleCommunications Cloud Native Core Policy
Version 1.5.0
OracleEnterprise Manager Base Platform
Versions 13.2, 13.3
OracleHospitality Guest Access
Versions 4.2.0, 4.2.1
OracleRest Data Services
Versions 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c
OracleRetail Xstore Point Of Service
Versions 7.1, 15.0, 16.0, 17.0

Weakness classification

CWE-203

References