GitHub Advisory DatabaseGHSA-W7JR-WQW6-54XCNon-constant time comparison of inbound TCP agent connection secret
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
3.5 Low
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:S/C:P/I:N/A:N
0.001 Low
EPSS
Percentile
49.3%
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier does not use a constant-time comparison validating the connection secret when an inbound TCP agent connection is initiated. This could potentially allow attackers to use statistical methods to obtain the connection secret.
Jenkins 2.219, LTS 2.204.2 now uses a constant-time comparison function for verifying connection secrets.
| CPE | Name | Operator | Version |
|---|---|---|---|
| org.jenkins-ci.main:jenkins-core | le | 2.218 | |
| org.jenkins-ci.main:jenkins-core | le | 2.204.1 |
References
www.openwall.com/lists/oss-security/2020/01/29/1
access.redhat.com/errata/RHBA-2020:0402
access.redhat.com/errata/RHBA-2020:0675
access.redhat.com/errata/RHSA-2020:0681
access.redhat.com/errata/RHSA-2020:0683
github.com/advisories/GHSA-w7jr-wqw6-54xc
github.com/jenkinsci/jenkins/commit/0ba36508187ff771bba87feaf03057496775064c
jenkins.io/security/advisory/2020-01-29/#SECURITY-1659
nvd.nist.gov/vuln/detail/CVE-2020-2101
Related
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
3.5 Low
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:S/C:P/I:N/A:N
0.001 Low
EPSS
Percentile
49.3%