Description
jasypt before 1.9.2 allows a timing attack against the password hash comparison.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jasypt | 1.9.2-1 | — |
| Debian 13 | jasypt | 1.9.2-1 | — |
| Debian 12 | jasypt | 1.9.2-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | jasypt | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | rhvm-appliance | 1:4.1.20171102.0-1.el7 | RHSA-2017:3141 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Single Sign On 7 | rh-sso7-keycloak +1 | 2.5.14-1.Final_redhat_1.1.jbcs.el6 | RHSA-2017:2905, RHSA-2017:2904 |
| Red Hat JBoss EAP 7 | eap7-artemis-native +1 | 1.1.0-13.redhat_4.ep7.el6 | RHSA-2017:2809, RHSA-2017:2808 |
| Red Hat JBoss EAP 7 | eap7-bouncycastle +3 | 1.56.0-3.redhat_2.2.ep7.el6 | RHSA-2017:2809, RHSA-2017:2808 |
| Red Hat JBoss EAP 7 | eap7-hibernate-validator +1 | 5.2.5-2.Final_redhat_2.1.ep7.el6 | RHSA-2017:2809, RHSA-2017:2808 |
| Red Hat JBoss EAP 7 | eap7-jasypt | 1.9.2-2.redhat_1.1.ep7.el6 | RHSA-2017:2809, RHSA-2017:2808 |
| Red Hat JBoss EAP 7 | eap7-jboss-ec2-eap +1 | 7.0.8-1.GA_redhat_1.ep7.el6 | RHSA-2017:2811 |
| Red Hat JBoss EAP 7 | eap7-jboss-jms-api_2.0_spec | 1.0.1-2.Final_redhat_1.1.ep7.el6 | RHSA-2017:2809, RHSA-2017:2808 |
| Red Hat JBoss EAP 7 | eap7-jboss-logmanager | 2.0.7-2.Final_redhat_1.1.ep7.el6 | RHSA-2017:2809, RHSA-2017:2808 |
| Red Hat JBoss EAP 7 | eap7-jboss-metadata +5 | 10.0.2-2.Final_redhat_1.1.ep7.el6 | RHSA-2017:2809, RHSA-2017:2808 |
| Red Hat JBoss EAP 7 | eap7-jboss-remote-naming | 2.0.5-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:2809, RHSA-2017:2808 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting | 4.0.24-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:2809, RHSA-2017:2808 |
| Red Hat JBoss EAP 7 | eap7-log4j-jboss-logmanager | 1.1.4-2.Final_redhat_1.1.ep7.el6 | RHSA-2017:2809, RHSA-2017:2808 |
| Red Hat JBoss EAP 7 | eap7-picketlink-api +9 | 2.5.5-9.SP8_redhat_1.1.ep7.el6 | RHSA-2017:2809, RHSA-2017:2808 |
| Red Hat JBoss EAP 7 | eap7-undertow | 1.3.31-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:2809, RHSA-2017:2808 |
| Red Hat JBoss EAP 7 | eap7-wildfly +1 | 7.0.8-4.GA_redhat_1.1.ep7.el6 | RHSA-2017:2809, RHSA-2017:2808 |
| Red Hat JBoss EAP 7 | eap7-wildfly-javadocs | 7.0.8-1.GA_redhat_1.1.ep7.el6 | RHSA-2017:2809, RHSA-2017:2808 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jasypt:jasypt | < 1.9.2 | 1.9.2 | GHSA-r5c2-rxh2-f5h2 |
Advisories 6
- RHSA-2017:2811 Red Hat Security Advisory: eap7-jboss-ec2-eap security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2017:3141 Red Hat Security Advisory: rhvm-appliance security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2017:2904 Red Hat Security Advisory: rh-sso7-keycloak security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2017:2905 Red Hat Security Advisory: rh-sso7-keycloak security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2017:2809 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2017:2808 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
References
- 1040360 vdb-entry
- RHSA-2017:2809 vendor-advisory
- RHSA-2017:2547 vendor-advisory
- RHSA-2017:2810 vendor-advisory
- 1039744 vdb-entry
- RHSA-2018:0294 vendor-advisory
- RHSA-2017:2808 vendor-advisory
- RHSA-2017:2546 vendor-advisory
- https://sourceforge.net/p/jasypt/code/668/
- RHSA-2017:3141 vendor-advisory
- RHSA-2017:2811 vendor-advisory