Information disclosure

Jenkins Gogs Plugin 1.0.15 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token...

CVE-2023-46660

Jenkins Zanata Plugin 0.6 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token hashes are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token...

CVE-2023-46658

Jenkins MSTeams Webhook Trigger Plugin 0.1.1 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token...

CVE-2023-46657

Jenkins Gogs Plugin 1.0.15 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token...

CVE-2023-46657

Jenkins Gogs Plugin 1.0.15 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token...

PT-2023-30147 · Jenkins · Jenkins Zanata Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Zanata Plugin versions 0.6 and earlier Description: The issue is related to the use of a non-constant time comparison function when checking whether the provided and expected webhook token hashes are equal. This potentially allows...

CLSA-2023-1697556743 Fix CVE(s): CVE-2022-48566

SECURITY UPDATE: Constant-time-defeating optimisations issue - debian/patches/CVE-2022-48566.patch: Make comparedigest more constant-time - CVE-2022-48566...

CLSA-2023-1697466063 python2: Fix of CVE-2022-48566

CVE-2022-48566: Make comparedigest more constant-time...

CLSA-2023-1697465384 python2: Fix of CVE-2022-48566

CVE-2022-48566: Make comparedigest more constant-time...

CLSA-2023-1697464069 python: Fix of CVE-2022-48566

CVE-2022-48566: Make comparedigest more constant-time...

CLSA-2023-1697463705 Fix CVE(s): CVE-2022-48566

SECURITY UPDATE: Constant-time-defeating optimisations issue - debian/patches/CVE-2022-48566.patch: Make comparedigest more constant-time - CVE-2022-48566...

CLSA-2023-1697463155 Fix CVE(s): CVE-2022-48566

SECURITY UPDATE: Constant-time-defeating optimisations issue - debian/patches/CVE-2022-48566.patch: Make comparedigest more constant-time - CVE-2022-48566...

CLSA-2023-1697462566 Fix CVE(s): CVE-2022-48566

SECURITY UPDATE: Constant-time-defeating optimisations issue - debian/patches/CVE-2022-48566.patch: Make comparedigest more constant-time - CVE-2022-48566...

[SECURITY] [DLA 3614-1] python3.7 security update

Debian LTS Advisory DLA-3614-1 [email protected] https://www.debian.org/lts/security/ Sean Whitton October 11, 2023 https://wiki.debian.org/LTS Package : python3.7 Version : 3.7.3-2+deb10u6 CVE ID : CVE-2022-48560 CVE-2022-48564 CVE-2022-48565 CVE-2022-48566 CVE-2023-40217 Several...

Debian dla-3614 : idle-python3.7 - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3614 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3614-1 [email protected]...

Timing Attack

python is vulnerable to Timing Attack. The vulnerability is caused by a loophole in hmac.comparedigest function making it deviate from constant time operation. An attacker can mount a timing attack by exploiting the accumulator variable result in the hmac.comparedigest function...

USN-6400-1 python2.7, python3.5 vulnerability

It was discovered that Python did not properly provide constant-time processing for a crypto operation. An attacker could possibly use this issue to perform a timing attack and recover sensitive information...

Debian: Security Advisory (DLA-3575-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Python < 3.6.13, 3.7.x < 3.7.10, 3.8.x < 3.8.7, 3.9.x < 3.9.1 Race Condition Vulnerability (bpo-40791) - Linux

Python is prone to a race condition vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:python:python"; ifdescription...

Debian dla-3575 : idle-python2.7 - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3575 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3575-1 [email protected]...