GHSA-w7jr-wqw6-54xc
Non-constant time comparison of inbound TCP agent connection secret
At a glance
- Published
- Updated
- CVE
- CVE-2020-2101
- Aliases
- BIT-jenkins-2020-2101
- CVSS_V3
- CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Description
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier does not use a constant-time comparison validating the connection secret when an inbound TCP agent connection is initiated. This could potentially allow attackers to use statistical methods to obtain the connection secret. Jenkins 2.219, LTS 2.204.2 now uses a constant-time comparison function for verifying connection secrets.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.jenkins-ci.main:jenkins-core | introduced 0, fixed 2.204.2 |
| Maven · org.jenkins-ci.main:jenkins-core | introduced 2.205, fixed 2.219 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-2101 ADVISORY
- https://github.com/jenkinsci/jenkins/commit/0ba36508187ff771bba87feaf03057496775064c WEB
- https://access.redhat.com/errata/RHBA-2020:0402 WEB
- https://access.redhat.com/errata/RHBA-2020:0675 WEB
- https://access.redhat.com/errata/RHSA-2020:0681 WEB
- https://access.redhat.com/errata/RHSA-2020:0683 WEB
- https://github.com/jenkinsci/jenkins PACKAGE
- https://jenkins.io/security/advisory/2020-01-29/#SECURITY-1659 WEB
- http://www.openwall.com/lists/oss-security/2020/01/29/1 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |