Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which…
Priority MEDIUM 45CWE-203Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 4 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-203.
Summary
Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.
Why it matters now
EPSS 0.09639 95th percentileScored 2026-11-07
Fix Partial org.eclipse.jetty:jetty-server (Maven): 9.4.6.v20170531, 9.3.20.v20170531, 9.2.22.v20170606Red Hat: 4 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.eclipse.jetty:jetty-server (Maven) | 9.4.0 to before 9.4.6.v20170531 | 9.4.6.v20170531 | Patch available | GHSA-wfcc-pff6-rgc5 |
| — | org.eclipse.jetty:jetty-server (Maven) | 9.3.0 to before 9.3.20.v20170531 | 9.3.20.v20170531 | Patch available | GHSA-wfcc-pff6-rgc5 |
| — | org.eclipse.jetty:jetty-server (Maven) | before 9.2.22.v20170606 | 9.2.22.v20170606 | Patch available | GHSA-wfcc-pff6-rgc5 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 9.4.0 to before 9.4.6.v20170531 Fixed in 9.4.6.v20170531 Patch available GHSA-wfcc-pff6-rgc5
- org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 9.3.0 to before 9.3.20.v20170531 Fixed in 9.3.20.v20170531 Patch available GHSA-wfcc-pff6-rgc5
- org.eclipse.jetty:jetty-server (Maven) Vendor— Affected before 9.2.22.v20170606 Fixed in 9.2.22.v20170606 Patch available GHSA-wfcc-pff6-rgc5
CPE configurations NVD · 15
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* | before 9.2.22; 9.3.0 to before 9.3.20; 9.4.0 to before 9.4.6 | Vulnerable | Eclipse Foundation |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.5.0:*:*:*:*:*:*:* | 1.5.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2:*:*:*:*:*:*:* | 13.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3:*:*:*:*:*:*:* | 13.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:* | 4.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:* | 4.2.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:rest_data_services:11.2.0.4:*:*:*:-:*:*:* | 11.2.0.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:rest_data_services:12.1.0.2:*:*:*:-:*:*:* | 12.1.0.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:rest_data_services:12.2.0.1:*:*:*:-:*:*:* | 12.2.0.1 | Vulnerable | Oracle |
- cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* Versions before 9.2.22; 9.3.0 to before 9.3.20; 9.4.0 to before 9.4.6 Vulnerable ·Eclipse Foundation
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.5.0:*:*:*:*:*:*:* Versions 1.5.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2:*:*:*:*:*:*:* Versions 13.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3:*:*:*:*:*:*:* Versions 13.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:* Versions 4.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:* Versions 4.2.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:rest_data_services:11.2.0.4:*:*:*:-:*:*:* Versions 11.2.0.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:rest_data_services:12.1.0.2:*:*:*:-:*:*:* Versions 12.1.0.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:rest_data_services:12.2.0.1:*:*:*:-:*:*:* Versions 12.2.0.1 Vulnerable ·Oracle
Show 5 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:rest_data_services:18c:*:*:*:-:*:*:* | 18c | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:* | 7.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:* | 15.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0:*:*:*:*:*:*:* | 16.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:* | 17.0 | Vulnerable | Oracle |
- cpe:2.3:a:oracle:rest_data_services:18c:*:*:*:-:*:*:* Versions 18c Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:* Versions 7.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:* Versions 17.0 Vulnerable ·Oracle
Remediation
- Fix · GHSA-wfcc-pff6-rgc5 org.eclipse.jetty:jetty-server (Maven) Fixed in 9.4.6.v20170531 Advisory →
- Fix · GHSA-wfcc-pff6-rgc5 org.eclipse.jetty:jetty-server (Maven) Fixed in 9.3.20.v20170531 Advisory →
- Fix · GHSA-wfcc-pff6-rgc5 org.eclipse.jetty:jetty-server (Maven) Fixed in 9.2.22.v20170606 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Fuse Integration Service 2 | Affected | No fix yet |
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
Timeline
- 2026-10-02 Threatist record created from CVE-2017-9735
- 2026-10-03 Alias added: GHSA-wfcc-pff6-rgc5
- 2026-11-06 EPSS moved to the 95th–99th percentile
References
Patch 2
Advisory 5
Other 15
- [pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1
- [activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities
- [hadoop-common-dev] 20191030 [jira] [Created] (HADOOP-16676) Security Vulnerability for dependency jetty-xml -please upgrade
- [hadoop-common-issues] 20191030 [jira] [Created] (HADOOP-16676) Security Vulnerability for dependency jetty-xml -please upgrade
- https://github.com/eclipse/jetty.project/commit/042f325f1cd6e7891d72c7e668f5947b5457dc02
- https://github.com/eclipse/jetty.project
- https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272@%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/36870f6c51f5bc25e6f7bb1fcace0e57e81f1524019b11f466738559@%3Ccommon-dev.hadoop.apache.org%3E
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/f887a5978f5e4c62b9cfe876336628385cff429e796962649649ec8a@%3Ccommon-issues.hadoop.apache.org%3E
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
- https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E
- https://web.archive.org/web/20170826163336/http://www.securityfocus.com/bid/99104
Sources
- CVE-2017-9735 · CVE Program
- CVE-2017-9735 · NVD
- FIRST EPSS
- GHSA-wfcc-pff6-rgc5 · GitHub Advisory Database · CC BY 4.0
- CVE-2017-9735 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences