What’s Vulnerable › Vulnerabilities

CVE-2014-9970

• Severity: high (CVSS 7.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-05-21 · updated 2026-06-17
• Weakness: CWE-200

Description

jasypt before 1.9.2 allows a timing attack against the password hash comparison.

Affected products

• Jasypt Project Jasypt: through 1.9.1

References

• http://www.securitytracker.com/id/1039744
• http://www.securitytracker.com/id/1040360
• https://access.redhat.com/errata/RHSA-2017:2546
• https://access.redhat.com/errata/RHSA-2017:2547
• https://access.redhat.com/errata/RHSA-2017:2808
• https://access.redhat.com/errata/RHSA-2017:2809
• https://access.redhat.com/errata/RHSA-2017:2810
• https://access.redhat.com/errata/RHSA-2017:2811
• https://access.redhat.com/errata/RHSA-2017:3141
• https://access.redhat.com/errata/RHSA-2018:0294
• https://sourceforge.net/p/jasypt/code/668/
• http://www.securitytracker.com/id/1039744

Get alerted when CVE-2014-9970 or the next vulnerability affects your stack