~ / search / GHSA-hj7p-h74j-6gxj

GHSA-hj7p-h74j-6gxj

Non-constant time nonce comparison in Jenkins Microsoft Entra ID (previously Azure AD) Plugin

Source: GitHub Advisory Database (reviewed) High CVE-2023-41935

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:azure-ad >= 378.380.v545b, < 397.v907382dd9b 397.v907382dd9b
Maven org.jenkins-ci.plugins:azure-ad < 378.vd6e2874a 378.vd6e2874a

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b_1154b_3fb_, uses a non-constant time comparison function when checking whether the provided and expected CSRF protection nonce are equal, potentially allowing attackers to use statistical methods to obtain a valid nonce.

References

External links from the advisory. They lead to third-party sites.