High severity · published Jun 16, 2017
CVE-2017-9735
Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before…
7.5
CVSS
5.8%
EPSS
No
On KEV
Description
Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)5.8% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Communications Cloud Native Core Policy · Oracle
1.5.0 · source: NVD
DL
Debian Linux · Debian
9.0 · source: NVD
EM
Enterprise Manager Base Platform · Oracle
13.2; 13.3 · source: NVD
HG
Hospitality Guest Access · Oracle
4.2.0; 4.2.1 · source: NVD
JE
Jetty · Eclipse
before 9.2.22; 9.3.0 before 9.3.20; 9.4.0 before 9.4.6 · source: NVD
RD
Rest Data Services · Oracle
11.2.0.4; 12.1.0.2; 12.2.0.1; 18c · source: NVD
RX
Retail Xstore Point OF Service · Oracle
7.1; 15.0; 16.0; 17.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-9735
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-9735
Third Party Advisory
http://www.securityfocus.com/bid/99104
Issue Tracking
https://bugs.debian.org/864631
Issue Tracking
https://github.com/eclipse/jetty.project/issues/1556
lists.apache.org
https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/36870f6c51f5bc25e6f7bb1fcace0e57e81f1524019b11f466738559%40%3Ccommon-dev.hadoop.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
More from Debian Linux
10.0
CVE-2025-32433
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
10.0
CVE-2025-24201
Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability
10.0
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
10.0
CVE-2015-3306
ProFTPD Improper Access Control Vulnerability
9.8
CVE-2026-24061
GNU InetUtils Argument Injection Vulnerability