https://bugzilla.redhat.com/show_bug.cgi?id=1464158
Bug ID: 1464158 Summary: CVE-2017-9735 jetty: Timing channel attack in util/security/Password.java Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: anemec@redhat.com CC: eclipse-sig@lists.fedoraproject.org, hhorak@redhat.com, java-sig-commits@lists.fedoraproject.org, jjohnstn@redhat.com, jorton@redhat.com, krzysztof.daniel@gmail.com, mizdebsk@redhat.com, msimacek@redhat.com
Jetty is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.
Upstream issue:
https://github.com/eclipse/jetty.project/issues/1556
Upstream patch:
https://github.com/eclipse/jetty.project/commit/042f325f1cd6e7891d72c7e668f5...