CVE-2014-9970: Apache Jasypt - Exposure of Sensitive Information
Summary
CVE-2014-9970: Exposure of Sensitive Information to an Unauthorized Actor in Apache Jasypt. Affects org.jasypt:jasypt versions < 1.9.2. Fixed in 1.9.2. How to fix ↓
Also tracked for
- jasypt · Debian:11
The same CVE-2014-9970 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Jasypt is a Java library that provides basic encryption capabilities. It is commonly used for securing sensitive information such as passwords, credit card numbers, and other confidential data. The library offers various encryption algorithms and hashing functions to protect data at rest and in transit. However, a vulnerability has been discovered in versions prior to 1.9.2 that allows for a timing attack against the password hash comparison.
Vulnerability Detail
The vulnerability in Apache Jasypt allows an unauthorized actor to exploit a timing attack against the password hash comparison. This attack takes advantage of the time taken to compare the password hash, allowing an attacker to deduce information about the hashed password. By carefully measuring the time it takes for the comparison, an attacker can gradually reconstruct the original password. This can lead to unauthorized access to sensitive information and potential compromise of user accounts.
How To Fix
Latest published version: 1.9.3 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of Apache Jasypt to mitigate the risk of exposure to sensitive information.
Conclusion
The exposure of sensitive information vulnerability in Apache Jasypt prior to version 1.9.2 can lead to unauthorized access to sensitive data and potential compromise of user accounts. It is crucial to upgrade to the fixed version of Apache Jasypt to mitigate the risk. No known workarounds are available for this vulnerability. For further support and guidance on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jasypt:jasypt →
FAQ
A timing attack is a type of side-channel attack that exploits variations in the time taken to perform certain operations. In the context of this vulnerability, it involves measuring the time it takes to compare password hashes to deduce information about the hashed password.
The vulnerability can lead to unauthorized access to sensitive information, such as user passwords. This can result in compromised user accounts, unauthorized data access, and potential privacy breaches.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it to identify any open-source vulnerabilities, including this one.
There are no known public exploits for this vulnerability at the time of this report. However, it is crucial to address the vulnerability promptly by upgrading to the fixed version of Apache Jasypt to mitigate the risk.
For further support on vulnerability remediation and assistance in securing your software, you can reach out to info@devnack.com. The Devnack team can provide guidance and help you ensure the security of your application.
