CVE-2024-23903 - Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token

Back Back to CVE browser

MEDIUM

Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token

Published Jan 24, 2024

5.3

MEDIUM

CVSS 3.1

EPSS 0.50%

Description

Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token.

Affected products

Vendor Jenkins Project Product Jenkins GitLab Branch Source Plugin Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=684.vea_fa_7c1e2fe3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Jenkins Project

Jenkins GitLab Branch Source Plugin

unaffected

Version	Status	Constraints
0	affected	<=684.vea_fa_7c1e2fe3

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-697

References (6)

http://www.openwall.com/lists/oss-security/2024/01/24/6
Mailing List
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-0341
Advisory
https://github.com/advisories/GHSA-f67f-2j6r-m4c9
Advisory
https://github.com/jenkinsci/gitlab-branch-source-plugin/commit/8bfe1046cf342b99419457b9336addbbf346f89a
https://nvd.nist.gov/vuln/detail/CVE-2024-23903
https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-2871
vendor-advisoryVendor Advisory

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2024/01/24/6		Mailing List
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-0341		Advisory
https://github.com/advisories/GHSA-f67f-2j6r-m4c9		Advisory
https://github.com/jenkinsci/gitlab-branch-source-plugin/commit/8bfe1046cf342b99419457b9336addbbf346f89a
https://nvd.nist.gov/vuln/detail/CVE-2024-23903
https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-2871		vendor-advisoryVendor Advisory