CVE-2017-9735 High Severity Vulnerability detected by WhiteSource

[mend-bolt-for-github]

CVE-2017-9735 - High Severity Vulnerability

Vulnerable Library - jetty-util-9.1.0.v20131115.jar

path: /root/.m2/repository/org/eclipse/jetty/jetty-util/9.1.0.v20131115/jetty-util-9.1.0.v20131115.jar

Library home page: http://www.eclipse.org/jetty

Dependency Hierarchy:

• jetty-server-9.1.0.v20131115.jar (Root Library)
  • jetty-http-9.1.0.v20131115.jar
    • ❌ jetty-util-9.1.0.v20131115.jar (Vulnerable Library)

Found in commit: f396e60bf74726f66a202d308a1f2865177e4bee

Vulnerability Details

Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.

Publish Date: 2017-06-16

URL: CVE-2017-9735

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Change files

Origin: jetty/jetty.project@f3751d7

Release Date: 2017-05-16

Fix Resolution: Replace or update the following file: Credential.java

---

Step up your Open Source Security Game with WhiteSource here