GHSA-f67f-2j6r-m4c9

    Dashboard / Vulnerabilities / GHSA-f67f-2j6r-m4c9

    GHSA-f67f-2j6r-m4c9

    Published: 24 Jan 2024Last Modified: 16 Feb 2024

    Summary: Non-constant time webhook token comparison in Jenkins GitLab Branch Source Plugin

    Details: Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook token are equal. This could potentially allow attackers to use statistical methods to obtain a valid webhook token. GitLab Branch Source Plugin 688.v5fa_356ee8520 uses a constant-time comparison function when validating the webhook token.

    References: https://nvd.nist.gov/vuln/detail/CVE-2024-23903, https://github.com/jenkinsci/gitlab-branch-source-plugin/commit/8bfe1046cf342b99419457b9336addbbf346f89a, https://github.com/jenkinsci/gitlab-branch-source-plugin, https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-2871, http://www.openwall.com/lists/oss-security/2024/01/24/6

    Affected packages

    Package

    Name: io.jenkins.plugins:gitlab-branch-source

    Purl: pkg:maven/io.jenkins.plugins/gitlab-branch-source

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -688.v5fa

    Affected versions

    0.0.5-alpha-2
    0.0.7-beta
    0.0.8-beta

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-f67f-2j6r-m4c9 | CVE-DB