Non-constant time comparison of inbound TCP agent connection secret
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier does not use a constant-time comparison validating the connection secret when an inbound TCP agent connection is initiated. This could potentially allow attackers to use statistical methods to obtain the connection secret. Jenkins 2.219, LTS 2.204.2 now uses a constant-time comparison function for verifying connection secrets.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-2101US | medium5.3 | — | ||
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier did not use a constant-time comparison function for validating connection secrets, which could potentially allow an attacker to u… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://www.openwall.com/lists/oss-security/2020/01/29/1WEB
- https://access.redhat.com/errata/RHBA-2020:0402WEB
- https://access.redhat.com/errata/RHBA-2020:0675WEB
- https://access.redhat.com/errata/RHSA-2020:0681WEB
- https://access.redhat.com/errata/RHSA-2020:0683WEB
- https://github.com/jenkinsci/jenkinsPACKAGE
- https://github.com/jenkinsci/jenkins/commit/0ba36508187ff771bba87feaf03057496775064cWEB
- https://jenkins.io/security/advisory/2020-01-29/#SECURITY-1659WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan