VulnerabilityModified
CVE-2014-9970
jasypt before 1.9.2 allows a timing attack against the password hash comparison.
HIGH 7.5EPSS 2.37%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.37%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
jasypt before 1.9.2 allows a timing attack against the password hash comparison.
- CVSS 3.0
- 7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 2.37% probability · 83th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- jasypt project/jasypt
- Source
- cve@mitre.org
References
- http://www.securitytracker.com/id/1039744
- http://www.securitytracker.com/id/1040360
- https://access.redhat.com/errata/RHSA-2017:2546
- https://access.redhat.com/errata/RHSA-2017:2547
- https://access.redhat.com/errata/RHSA-2017:2808
- https://access.redhat.com/errata/RHSA-2017:2809
- https://access.redhat.com/errata/RHSA-2017:2810
- https://access.redhat.com/errata/RHSA-2017:2811
- https://access.redhat.com/errata/RHSA-2017:3141
- https://access.redhat.com/errata/RHSA-2018:0294
- https://sourceforge.net/p/jasypt/code/668/Issue Tracking, Patch, Third Party Advisory
- http://www.securitytracker.com/id/1039744
- http://www.securitytracker.com/id/1040360
- https://access.redhat.com/errata/RHSA-2017:2546
- https://access.redhat.com/errata/RHSA-2017:2547
- https://access.redhat.com/errata/RHSA-2017:2808
- https://access.redhat.com/errata/RHSA-2017:2809
- https://access.redhat.com/errata/RHSA-2017:2810
- https://access.redhat.com/errata/RHSA-2017:2811
- https://access.redhat.com/errata/RHSA-2017:3141
- https://access.redhat.com/errata/RHSA-2018:0294
- https://sourceforge.net/p/jasypt/code/668/Issue Tracking, Patch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.