Skip to content
OpenAdvisories
High DLA-1020-1 1 CVE

jetty - security update

Published Jul 9, 2017 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 7 jetty 6.1.26-1+deb7u1

Vulnerabilities 1

  • High 7.5
    CVE-2017-9735

    Jetty vulnerable to exposure of sensitive information due to observable discrepancy

    Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.

    jetty9 jetty9 org.eclipse.jetty:jetty-server jetty Debian Ubuntu Maven