https://bugzilla.redhat.com/show_bug.cgi?id=1464158
Bug ID: 1464158
Summary: CVE-2017-9735 jetty: Timing channel attack in
util/security/Password.java
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: eclipse-sig(a)lists.fedoraproject.org,
hhorak(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jjohnstn(a)redhat.com, jorton(a)redhat.com,
krzysztof.daniel(a)gmail.com, mizdebsk(a)redhat.com,
msimacek(a)redhat.com
Jetty is prone to a timing channel in util/security/Password.java, which makes
it easier for remote attackers to obtain access by observing elapsed times
before rejection of incorrect passwords.
Upstream issue:
https://github.com/eclipse/jetty.project/issues/1556
Upstream patch:
https://github.com/eclipse/jetty.project/commit/042f325f1cd6e7891d72c7e66...
--
You are receiving this mail because:
You are on the CC list for the bug.