Information Disclosure

2023-03-0700:49:21

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

jenkins-2-plugins

information disclosure

vulnerability

non-constant time comparison

webhook signatures

statistical methods

0.001 Low

EPSS

Percentile

33.5%

JSON

jenkins-2-plugins is vulnerable to Information Disclosure. The vulnerability exists due to the non-constant time comparison function in the library when checking whether the provided and computed webhook signatures are equal, allowing attackers to use statistical methods to obtain a valid webhook signature.

CPENameOperatorVersion
jenkins-2-pluginseq4.9.1644822177__1.el8
jenkins-2-pluginseq4.10.1663599478__1.el8
jenkins-2-pluginseq4.10.1650890594__1.el8
jenkins-2-pluginseq4.10.1647505461__1.el8
jenkins-2-pluginseq4.6.1609853716__1.el8
jenkins-2-pluginseq4.9.1642607680__1.el8
jenkins-2-pluginseq4.9.1669894222__1.el8
jenkins-2-pluginseq4.6.1643965689__1.el8
jenkins-2-pluginseq4.6.1650364520__1.el8
jenkins-2-pluginseq4.8.1624022417__1.el8

Name	Operator	Version
jenkins-2-plugins	eq	4.9.1644822177__1.el8
jenkins-2-plugins	eq	4.10.1663599478__1.el8
jenkins-2-plugins	eq	4.10.1650890594__1.el8
jenkins-2-plugins	eq	4.10.1647505461__1.el8
jenkins-2-plugins	eq	4.6.1609853716__1.el8
jenkins-2-plugins	eq	4.9.1642607680__1.el8
jenkins-2-plugins	eq	4.9.1669894222__1.el8
jenkins-2-plugins	eq	4.6.1643965689__1.el8
jenkins-2-plugins	eq	4.6.1650364520__1.el8
jenkins-2-plugins	eq	4.8.1624022417__1.el8