GitHub Advisoryadvisory · Maven

GHSA-9grj-j43m-mjqr Observable timing discrepancy allows determining username validity in Jenkins

MEDIUM Published 2022-06-24 Modified 2022-12-05 Official page ↗
Aliases
CVE-2022-34174
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-203, CWE-208
Reviewed
2022-12-05

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: >= 2.334, < 2.356 → fixed in 2.356 • Maven org.jenkins-ci.main:jenkins-core: < 2.332.4 → fixed in 2.332.4

Description

In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm. This allows attackers to determine the validity of attacker-specified usernames. Login attempts with an invalid username now validate a synthetic password to eliminate the timing discrepancy in Jenkins 2.356, LTS 2.332.4.

Related

Alias · CVE (1)

  • CVE-2022-34174 In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between… vulnerability

Weakness · CWE (2)

  • CWE-203 Observable Discrepancy weakness
  • CWE-208 Observable Timing Discrepancy weakness

References