| Package | Affected versions | Patched versions |
|---|---|---|
| org.eclipse.jetty:jetty-server | ≥ 9.3.0, < 9.3.20.v20170531≥ 9.4.0, < 9.4.6.v20170531< 9.2.22.v20170606 | 9.3.20.v201705319.4.6.v201705319.2.22.v20170606 |
| jetty | ≥ 9.3.0, < 9.3.20≥ 9.4.0, < 9.4.6< 9.2.22 | 9.3.209.4.69.2.22 |
| communications cloud native core policy | = 1.5.0 | |
| enterprise manager base platform | = 13.2= 13.3 | |
| hospitality guest access | = 4.2.0= 4.2.1 | |
| rest data services | = 11.2.0.4= 12.1.0.2= 12.2.0.1= 18c | |
| retail xstore point of service | = 15.0= 16.0= 17.0= 7.1 |
Jetty through 9.4.x contains a timing channel attack in util/security/Password.java, which allows attackers to obtain access by observing elapsed times before rejection of incorrect passwords.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free