An open API service providing security vulnerability metadata for many open source software ecosystems.

GSA_kwCzR0hTQS1majZmLTY5MzMtODM5as4AAjcN

Moderate EPSS: 0.01523% (0.80429 Percentile) EPSS:

Non-constant time HMAC comparison

Affected Packages Affected Versions Fixed Versions
maven:org.jenkins-ci.main:jenkins-core >= 2.205, <= 2.218, <= 2.204.1 2.219, 2.204.2

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier does not use a constant-time comparison when checking whether two HMACs are equal. This could potentially allow attackers to use statistical methods to obtain a valid HMAC for an attacker-controlled input value.

Jenkins 2.219, LTS 2.204.2 now uses a constant-time comparison when validating HMACs.

References: