This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2017-9735 →

DEBIAN-CVE-2017-9735

Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observ...

Original description

The description as published by the source.

Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 jetty9

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.22-1"}]}]

Debian:13 jetty9

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.22-1"}]}]

Debian:14 jetty9

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.22-1"}]}]

References

advisory security-tracker.debian.org