GitHub Advisoryadvisory · Maven

GHSA-w7jr-wqw6-54xc Non-constant time comparison of inbound TCP agent connection secret

MEDIUM Published 2022-05-24 Modified 2022-12-19 Official page ↗
Aliases
CVE-2020-2101
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-203, CWE-208
Reviewed
2022-12-19

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: < 2.204.2 → fixed in 2.204.2 • Maven org.jenkins-ci.main:jenkins-core: >= 2.205, < 2.219 → fixed in 2.219

Description

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier does not use a constant-time comparison validating the connection secret when an inbound TCP agent connection is initiated. This could potentially allow attackers to use statistical methods to obtain the connection secret. Jenkins 2.219, LTS 2.204.2 now uses a constant-time comparison function for verifying connection secrets.

Related

Alias · CVE (1)

  • CVE-2020-2101 Jenkins 2.218 and earlier, LTS 2.204.1 and earlier did not use a constant-time comparison function for validating connection secrets, which… vulnerability

Weakness · CWE (2)

  • CWE-203 Observable Discrepancy weakness
  • CWE-208 Observable Timing Discrepancy weakness

References