~ / search / GHSA-5r33-mgjf-6656

GHSA-5r33-mgjf-6656

Jenkins Tuleap Authentication Plugin non-constant time token comparison

Source: GitHub Advisory Database (reviewed) Low CVE-2023-40343

Packages

EcosystemPackageAffectedFixed in
Maven io.jenkins.plugins:tuleap-oauth < 1.1.21 1.1.21

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Tuleap Authentication Plugin 1.1.20 and earlier does not use a constant-time comparison when checking whether two authentication tokens are equal. This could potentially allow attackers to use statistical methods to obtain a valid authentication token. Tuleap Authentication Plugin 1.1.21 uses a constant-time comparison when validating authentication tokens.

References

External links from the advisory. They lead to third-party sites.