CVE-2017-9735

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-06-16 · updated 2026-06-17
Weakness: CWE-203

Description

Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.

Affected products

Debian Linux: 9.0
The Eclipse Foundation Eclipse Jetty: before 9.2.22; from 9.3.0 before 9.3.20; from 9.4.0 before 9.4.6 — fixed in 9.2.22, 9.3.20, 9.4.6
Oracle Communications Cloud Native Core Policy: 1.5.0
Oracle Corporation Enterprise Manager Base Platform: 13.2, 13.3
Oracle Corporation Hospitality Guest Access: 4.2.0, 4.2.1
Oracle Corporation Oracle REST Data Services: 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c
Oracle Corporation Retail Xstore Point of Service: 7.1, 15.0, 16.0, 17.0

How to fix

Upgrade to a fixed version: The Eclipse Foundation Eclipse Jetty 9.2.22, 9.3.20, 9.4.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2017-9735 or the next vulnerability affects your stack