~ / search / GHSA-2xpq-5952-38w3

GHSA-2xpq-5952-38w3

Jenkins MSTeams Webhook Trigger Plugin uses non-constant time webhook token comparison

Source: GitHub Advisory Database (reviewed) Low CVE-2023-46658

Packages

EcosystemPackageAffectedFixed in
Maven io.jenkins.plugins:teams-webhook-trigger <= 0.1.1 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins MSTeams Webhook Trigger Plugin 0.1.1 and earlier does not use a constant-time comparison when checking whether the provided and expected webhook token are equal. This could potentially allow attackers to use statistical methods to obtain a valid webhook token. As of publication of this advisory, there is no fix.

References

External links from the advisory. They lead to third-party sites.