In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm. This allows attackers to determine the validity of attacker-specified usernames.

Login attempts with an invalid username now validate a synthetic password to eliminate the timing discrepancy in Jenkins 2.356, LTS 2.332.4.

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-34174
• https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2566
• jenkinsci/jenkins@957ef59