Exposure of Sensitive Information to an Unauthorized Actor
jasypt before 1.9.2 allows a timing attack against the password hash comparison.
Advisories for Maven/Org.jasypt/Jasypt package
2022
jasypt before 1.9.2 allows a timing attack against the password hash comparison.