jasypt before 1.9.2 allows a timing attack against the password hash comparison.
Priority LOW 37CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 11 fixed, 4 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.
Summary
jasypt before 1.9.2 allows a timing attack against the password hash comparison.
Why it matters now
EPSS 0.02366 83rd percentileScored 2026-11-07
Fix Partial org.jasypt:jasypt (Maven): 1.9.2Red Hat: 11 advisoriesRed Hat: 11 fixed, 4 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.jasypt:jasypt (Maven) | before 1.9.2 | 1.9.2 | Patch available | GHSA-r5c2-rxh2-f5h2 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.jasypt:jasypt (Maven) Vendor— Affected before 1.9.2 Fixed in 1.9.2 Patch available GHSA-r5c2-rxh2-f5h2
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:jasypt_project:jasypt:*:*:*:*:*:*:*:* | up to 1.9.1 | Vulnerable | Jasypt Project |
- cpe:2.3:a:jasypt_project:jasypt:*:*:*:*:*:*:*:* Versions up to 1.9.1 Vulnerable ·Jasypt Project
Remediation
- Fix · GHSA-r5c2-rxh2-f5h2 org.jasypt:jasypt (Maven) Fixed in 1.9.2 Advisory →
Red Hat 11 advisories
- RHSA-2018:0294 Released 2018-02-12 · Red Hat rating ImportantRed Hat JBoss Data Grid 7.1.2 security update
- Red Hat Data Grid 7.1.2
- RHSA-2017:3141 Released 2017-11-07 · Red Hat rating Importantrhvm-appliance security, bug fix, and enhancement update
- Red Hat Virtualization 4 Hypervisor for RHEL 7 rhvm-appliance-1:4.1.20171102.0-1.el7
- Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts rhvm-appliance-1:4.1.20171102.0-1.el7
- RHSA-2017:2905 Released 2017-10-17 · Red Hat rating Moderaterh-sso7-keycloak security update
- Red Hat Single Sign-On 7.1 for RHEL 7 Server rh-sso7-keycloak-2.5.14-1.Final_redhat_1.1.jbcs.el7, rh-sso7-keycloak-server-2.5.14-1.Final_redhat_1.1.jbcs.el7
Show 8 more Red Hat advisories
- RHSA-2017:2904 Released 2017-10-17 · Red Hat rating Moderaterh-sso7-keycloak security update
- Red Hat Single Sign-On 7.1 for RHEL 6 Server rh-sso7-keycloak-2.5.14-1.Final_redhat_1.1.jbcs.el6, rh-sso7-keycloak-server-2.5.14-1.Final_redhat_1.1.jbcs.el6
- RHSA-2017:2906 Released 2017-10-17 · Red Hat rating ModerateRed Hat Single Sign-On security update
- Red Hat Single Sign-On 7.1
- RHSA-2017:2811 Released 2017-09-26 · Red Hat rating Importanteap7-jboss-ec2-eap security update
- Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-jboss-ec2-eap-7.0.8-1.GA_redhat_1.ep7.el6, eap7-jboss-ec2-eap-samples-7.0.8-1.GA_redhat_1.ep7.el6
- Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-jboss-ec2-eap-7.0.8-1.GA_redhat_1.ep7.el7, eap7-jboss-ec2-eap-samples-7.0.8-1.GA_redhat_1.ep7.el7
- RHSA-2017:2809 Released 2017-09-26 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform security update
- Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-artemis-native-1.1.0-13.redhat_4.ep7.el6, eap7-artemis-native-wildfly-1.1.0-13.redhat_4.ep7.el6, eap7-bouncycastle-1.56.0-3.redhat_2.2.ep7.el6 +31
- RHSA-2017:2808 Released 2017-09-26 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform security update
- Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-artemis-native-1.1.0-13.redhat_4.ep7.el7, eap7-artemis-native-wildfly-1.1.0-13.redhat_4.ep7.el7, eap7-bouncycastle-1.56.0-3.redhat_2.2.ep7.el7 +31
- RHSA-2017:2810 Released 2017-09-26 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform security update
- Red Hat JBoss EAP 7.0
- RHSA-2017:2546 Released 2017-08-29 · Red Hat rating ImportantRed Hat JBoss BPM Suite 6.4.5 security update
- Red Hat JBoss BPMS 6.4
- RHSA-2017:2547 Released 2017-08-29 · Red Hat rating ImportantRed Hat JBoss BRMS 6.4.5 security update
- Red Hat JBoss BRMS 6.4
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss BRMS 5 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Data Grid 7 | Affected | No fix yet |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Enterprise 2 | Affected | — |
| Red Hat Data Grid 7.1.2 | Fixed | RHSA-2018:0294 |
| Red Hat JBoss BPMS 6.4 | Fixed | RHSA-2017:2546 |
| Red Hat JBoss BRMS 6.4 | Fixed | RHSA-2017:2547 |
| Red Hat JBoss EAP 7.0 | Fixed | RHSA-2017:2810 |
| Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server | Fixed | RHSA-2017:2809, RHSA-2017:2811 |
| Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server | Fixed | RHSA-2017:2808, RHSA-2017:2811 |
| Red Hat Single Sign-On 7.1 | Fixed | RHSA-2017:2906 |
| Red Hat Single Sign-On 7.1 for RHEL 6 Server | Fixed | RHSA-2017:2904 |
| Red Hat Single Sign-On 7.1 for RHEL 7 Server | Fixed | RHSA-2017:2905 |
| Red Hat Virtualization 4 Hypervisor for RHEL 7 | Fixed | RHSA-2017:3141 |
| Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts | Fixed | RHSA-2017:3141 |
Not affected: 2 products
- Red Hat JBoss A-MQ 6
- Red Hat JBoss Fuse 6
Timeline
- 2026-10-02 Threatist record created from CVE-2014-9970
- 2026-10-03 Alias added: GHSA-r5c2-rxh2-f5h2
- 2026-11-06 Fix available: Red Hat JBoss EAP 7.0 · Red Hat
References
Sources
- CVE-2014-9970 · CVE Program
- CVE-2014-9970 · NVD
- FIRST EPSS
- GHSA-r5c2-rxh2-f5h2 · GitHub Advisory Database · CC BY 4.0
- CVE-2014-9970 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences