Description

Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify API tokens, which makes it easier for remote attackers to determine API tokens via a brute-force approach.

Remediation

References

http://rhn.redhat.com/errata/RHSA-2016-1773.html

https://access.redhat.com/errata/RHSA-2016:0711

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-02-24

Related Vulnerabilities

CVE-2022-41704 Vulnerability in maven package org.apache.xmlgraphics:batik-bridge

CVE-2013-7315 Vulnerability in maven package org.springframework:spring-web

CVE-2022-36084 Vulnerability in npm package cruddl

CVE-2016-10536 Vulnerability in npm package engine.io-client

CVE-2022-40764 Vulnerability in npm package snyk

Severity

Medium

Classification

CWE-200 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Patch Vendor Advisory