CVE-2022-43411

🗓️ 19 Oct 2022 00:00:00Reported by jenkinsType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 82 Views

Jenkins GitLab Plugin 1.5.35 and earlier uses a non-constant time comparison function when checking webhook token equality

Reporter	Title	Published	Views	Family All 11
CNNVD	Jenkins Plugin GitLab 安全漏洞	19 Oct 202200:00	–	cnnvd
Cvelist	CVE-2022-43411	19 Oct 202200:00	–	cvelist
EUVD	EUVD-2022-7090	3 Oct 202520:07	–	euvd
Github Security Blog	Non-constant time webhook token comparison in Jenkins GitLab Plugin	19 Oct 202219:00	–	github
Tenable Nessus	Jenkins plugins Multiple Vulnerabilities (2022-10-19)	3 Mar 202300:00	–	nessus
NVD	CVE-2022-43411	19 Oct 202216:15	–	nvd
OSV	GHSA-F9F9-4R63-4QCC Non-constant time webhook token comparison in Jenkins GitLab Plugin	19 Oct 202219:00	–	osv
Prion	Code injection	19 Oct 202216:15	–	prion
Positive Technologies	PT-2022-26896 · Jenkins · Jenkins Git Plugin +1	19 Oct 202200:00	–	ptsecurity
RedhatCVE	CVE-2022-43411	23 May 202500:05	–	redhatcve

NVD

Node

jenkins gitlabRange<1.5.36jenkins

[
  {
    "product": "Jenkins GitLab Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "lessThanOrEqual": "1.5.35",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]