CVE-2017-9735
Fixed in a distro release EPSS 6%
Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.
Products: eclipse jetty, debian_linux, oracle communications_cloud_native_core_policy, oracle enterprise_manager_base_platform, oracle hospitality_guest_access, oracle rest_data_services, oracle retail_xstore_point_of_service
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.eclipse.jetty:jetty-server | 9.4.6.v20170531 |
| Maven | org.eclipse.jetty:jetty-server | 9.3.20.v20170531 |
| Maven | org.eclipse.jetty:jetty-server | 9.2.22.v20170606 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | hadoop-fips-3.3.6 | no fix |
| Chainguard | hadoop-fips-3.4.2 | no fix |
| Chainguard | hadoop-fips-3.5 | no fix |
| Debian 12 | jetty9 | 9.2.22-1 |
| Debian 13 | jetty9 | 9.2.22-1 |
| Debian 14 | jetty9 | 9.2.22-1 |
| Debian 7 | jetty | 6.1.26-1+deb7u1 |
| Debian 7 | jetty8 | 8.1.3-4+deb7u1 |
| Debian 9 | jetty9 | 9.2.30-0+deb9u1 |
| Ubuntu 14.04 LTS | jetty | 6.1.26-1ubuntu1.2 |
| Ubuntu 14.04 LTS | jetty8 | no fix |
| Ubuntu 16.04 LTS | jetty | 6.1.26-5ubuntu0.1 |
| Ubuntu 16.04 LTS | jetty8 | no fix |
| Ubuntu 16.04 LTS | jetty9 | no fix |