Timing Attack Vulnerability in jasypt Package
Summary
CVE-2014-9970: jasypt before 1.9.2 allows a timing attack against the password hash comparison. Affects jasypt versions < 1.9.2-1. Fixed in 1.9.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jasypt is a popular Java library that provides encryption capabilities for Java applications. It simplifies the process of encrypting and decrypting data, making it easier for developers to secure sensitive information. However, prior to version 1.9.2, jasypt was susceptible to a timing attack during password hash comparisons, which could potentially allow attackers to gain unauthorized access to sensitive data.
Vulnerability Detail
The vulnerability identified as CVE-2014-9970 in jasypt versions before 1.9.2 allows attackers to exploit timing discrepancies in password hash comparisons. This flaw can lead to a situation where an attacker can determine valid passwords through careful observation of the time it takes to process authentication requests. The implications of this vulnerability are severe, as it can compromise the security of applications relying on jasypt for encryption, allowing unauthorized access to sensitive information.
How To Fix
Minimum fixed version
1.9.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jasyptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider implementing a custom password comparison method that uses a constant-time algorithm to mitigate the risk of timing attacks. This can be done by using libraries that provide secure password hashing functions, such as bcrypt or Argon2, which are designed to resist timing attacks.
Conclusion
The jasypt package has a critical vulnerability (CVE-2014-9970) that allows timing attacks on password hash comparisons. Users are strongly advised to upgrade to version 1.9.2 or later to mitigate this risk. For those unable to upgrade immediately, implementing a secure password comparison method is recommended.
See every vulnerability recorded for jasypt →
FAQ
CVE-2014-9970 is a vulnerability in the jasypt library that allows timing attacks against password hash comparisons.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can allow attackers to gain unauthorized access to sensitive data by determining valid passwords through timing analysis.
All versions of jasypt before 1.9.2 are affected by this vulnerability.
If immediate upgrading is not feasible, implement a custom password comparison method using a constant-time algorithm to reduce the risk of timing attacks.
Related vulnerabilities
Recent vulnerabilities recorded for jasypt.
