Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| org.eclipse.jetty:jetty-server(Maven) | 9.4.0 | 9.4.6.v20170531 | N/A |
| org.eclipse.jetty:jetty-server(Maven) | 9.3.0 | 9.3.20.v20170531 | N/A |
| org.eclipse.jetty:jetty-server(Maven) | 0 | 9.2.22.v20170606 | N/A |
CVSS Metrics
