Observable Discrepancy and Observable Timing Discrepancy in Jenkins Configuration as Code Plugin
Low severity
GitHub Reviewed
Published
Jan 21, 2022
to the GitHub Advisory Database
•
Updated Dec 27, 2023
Package
Affected versions
= 1.55
= 1.54
>= 1.48, < 1.53.1
< 1.47.1
Patched versions
1.55.1
1.54.1
1.53.1
1.47.1
Description
Published by the National Vulnerability Database
Jan 12, 2022
Reviewed
Jan 20, 2022
Published to the GitHub Advisory Database
Jan 21, 2022
Last updated
Dec 27, 2023
Credits
-
NotMyFault Analyst
-
westonsteimel Analyst
Jenkins Configuration as Code Plugin prior to 1.55.1, 1.54.1, 1.53.1, and 1.47.1 does not use a constant-time comparison when checking whether two authentication tokens are equal.
This could potentially allow attackers to use statistical methods to obtain a valid authentication token.
Configuration as Code Plugin 1.55.1, 1.54.1, 1.53.1, and 1.47.1 now uses a constant-time comparison when validating authentication tokens.
References