User enumeration In org.jenkins-ci.main:jenkins-core
Description
Non-constant time HMAC comparison Jenkins 2.218 and earlier, LTS 2.204.1 and earlier does not use a constant-time comparison when checking whether two HMACs are equal. This could potentially allow attackers to use statistical methods to obtain a valid HMAC for an attacker-controlled input value.
Jenkins 2.219, LTS 2.204.2 now uses a constant-time comparison when validating HMACs.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 maven | 2.204.2, 2.219 |
Aliases
1. 2. 3. 4. 5. 6. 7. 8.
References
1. 2. 3.