CVE-2014-9970

CVE-2014-9970 describes a timing attack vulnerability in jasypt versions prior to 1.9.2, affecting the password hash comparison function. This high-severity vulnerability (CVSS 7.5) allows an unauthenticated attacker to remotely deduce password hashes due to timing differences in the comparison process, potentially leading to unauthorized access. Despite its severity, there is no evidence of active exploitation, publicly available exploit code, or significant community discussion or media coverage.