jetty-project/jetty.project — pull request #1 by BenBE (2014-07-13 17:34:43+00:00)
Title: Jetty-Util credential timing

When comparing credentials, especially MD5 sums (WTF, why are there still MD5 sums???) the unsalted hash of the stored password is leaked in a timing side channel. Based on this information an attacker might reconstruct the password hash and thus obtain the cleartext password through dictionary attacks or precomputed password lists.