~ / search / GHSA-fj6f-6933-839j

GHSA-fj6f-6933-839j

Non-constant time HMAC comparison

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-2102

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.main:jenkins-core < 2.204.2 2.204.2
Maven org.jenkins-ci.main:jenkins-core >= 2.205, < 2.219 2.219

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier does not use a constant-time comparison when checking whether two HMACs are equal. This could potentially allow attackers to use statistical methods to obtain a valid HMAC for an attacker-controlled input value. Jenkins 2.219, LTS 2.204.2 now uses a constant-time comparison when validating HMACs.

References

External links from the advisory. They lead to third-party sites.