← All advisories

High severity7.5NVD Advisory· Published May 21, 2017· Updated Jun 17, 2026

CVE-2014-9970

CVE-2014-9970

Description

jasypt before 1.9.2 allows a timing attack against the password hash comparison.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.jasypt:jasyptMaven	< 1.9.2	1.9.2

Affected products

3

Jasypt/Jasypt
cpe:2.3:a:jasypt_project:jasypt:*:*:*:*:*:*:*:*
Range: <=1.9.1
Jasypt/jasypt: java simplified encryptionllm-create
Range: <1.9.2
ghsa-coords
pkg:maven/org.jasypt/jasypt
Range: < 1.9.2

Patches

Vulnerability mechanics

References

14

sourceforge.net/p/jasypt/code/668/nvdIssue TrackingPatchThird Party Advisory
github.com/advisories/GHSA-r5c2-rxh2-f5h2ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2014-9970ghsaADVISORY
access.redhat.com/errata/RHSA-2017:2546nvdWEB
access.redhat.com/errata/RHSA-2017:2547nvdWEB
access.redhat.com/errata/RHSA-2017:2808nvdWEB
access.redhat.com/errata/RHSA-2017:2809nvdWEB
access.redhat.com/errata/RHSA-2017:2810nvdWEB
access.redhat.com/errata/RHSA-2017:2811nvdWEB
access.redhat.com/errata/RHSA-2017:3141nvdWEB
access.redhat.com/errata/RHSA-2018:0294nvdWEB
sourceforge.net/p/jasypt/code/668ghsaWEB
www.securitytracker.com/id/1039744nvd
www.securitytracker.com/id/1040360nvd

News mentions

0

No linked articles in our index yet.