CVE-2017-9735 - 漏洞详情

CVE-2017-9735 (CNNVD-201706-727)

HIGH

中文标题:

Jetty 信息泄露漏洞

英文标题:

Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easi...

CVSS分数: 7.5

发布时间: 2017-06-16 21:00:00

漏洞类型: 信息泄露

状态: PUBLISHED

数据质量分数: 0.30

数据版本: v3

漏洞描述

中文描述:

Eclipse Jetty是Eclipse基金会的一个开源的、基于Java的Web服务器和Java Servlet容器。 Jetty 9.4.x及之前的版本中util/security/Password.java文件存在信息泄露漏洞。远程攻击者可利用该漏洞获取访问权限。

英文描述:

Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.

CWE类型:

CWE-203

受影响产品

厂商	产品	版本	版本范围	平台	CPE
eclipse	jetty	*	-	-	`cpe:2.3:a:eclipse:jetty::::::::`
debian	debian_linux	9.0	-	-	`cpe:2.3:o:debian:debian_linux:9.0:::::::*`
oracle	communications_cloud_native_core_policy	1.5.0	-	-	`cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.5.0:::::::*`
oracle	enterprise_manager_base_platform	13.2	-	-	`cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2:::::::*`
oracle	enterprise_manager_base_platform	13.3	-	-	`cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3:::::::*`
oracle	hospitality_guest_access	4.2.0	-	-	`cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:::::::*`
oracle	hospitality_guest_access	4.2.1	-	-	`cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:::::::*`
oracle	rest_data_services	11.2.0.4	-	-	`cpe:2.3:a:oracle:rest_data_services:11.2.0.4::::-:::`
oracle	rest_data_services	12.1.0.2	-	-	`cpe:2.3:a:oracle:rest_data_services:12.1.0.2::::-:::`
oracle	rest_data_services	12.2.0.1	-	-	`cpe:2.3:a:oracle:rest_data_services:12.2.0.1::::-:::`
oracle	rest_data_services	18c	-	-	`cpe:2.3:a:oracle:rest_data_services:18c::::-:::`
oracle	retail_xstore_point_of_service	7.1	-	-	`cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:::::::*`
oracle	retail_xstore_point_of_service	15.0	-	-	`cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:::::::*`
oracle	retail_xstore_point_of_service	16.0	-	-	`cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0:::::::*`
oracle	retail_xstore_point_of_service	17.0	-	-	`cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:::::::*`

解决方案

中文解决方案:

（暂无数据）

英文解决方案:

（暂无数据）

临时解决方案:

（暂无数据）

参考链接

99104 vdb-entry
cve.org

访问

[pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1 mailing-list
cve.org

访问

[activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar mailing-list
cve.org

访问

[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
cve.org

访问

[drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
cve.org

访问

[hadoop-common-dev] 20191030 [jira] [Created] (HADOOP-16676) Security Vulnerability for dependency jetty-xml -please upgrade mailing-list
cve.org

访问

[hadoop-common-issues] 20191030 [jira] [Created] (HADOOP-16676) Security Vulnerability for dependency jetty-xml -please upgrade mailing-list
cve.org

访问