Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify API tokens, which makes it easier for remote attackers to determine API tokens via a brute-force approach.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Jenkins 2016 02 24 | — | Upgrade Jenkins to version 1.650Upgrade Jenkins to the latest versionUpgrade Jenkins LTS to the latest versionUpgrade Jenkins LTS to version 1.642.2 | Nov 13, 2017 | Apr 7, 2016 |
| Redhat Openshift | — | Upgrade ImageMagickUpgrade rubygem-openshift-origin-frontend-haproxy-sni-proxyUpgrade jenkins-plugin-durable-taskUpgrade openshift-origin-node-proxyUpgrade rhcUpgrade openshift-origin-cartridge-pythonUpgrade openshift-origin-cartridge-mysqlUpgrade openshift-origin-cartridge-nodejsUpgrade openshift-origin-cartridge-diyUpgrade jenkinsUpgrade openshift-origin-cartridge-jbossewsUpgrade openshift-origin-msg-node-mcollectiveUpgrade rubygem-openshift-origin-nodeUpgrade rubygem-openshift-origin-msg-broker-mcollectiveUpgrade jenkins-plugin-credentialsUpgrade rubygem-openshift-origin-admin-consoleUpgrade openshift-origin-cartridge-haproxyUpgrade openshift-origin-cartridge-jenkins-clientUpgrade libcgroupUpgrade rubygem-openshift-origin-routing-daemonUpgrade activemqUpgrade openshift-origin-cartridge-jenkinsUpgrade jenkins-plugin-openshift-pipelineUpgrade openshift-origin-broker-utilUpgrade openshift-origin-node-utilUpgrade openshift-origin-cartridge-phpUpgrade openshift-origin-cartridge-jbosseapUpgrade openshift-origin-cartridge-cronUpgrade openshift-origin-cartridge-mongodbUpgrade jenkins-plugin-kubernetesUpgrade openshift-origin-cartridge-perlUpgrade openshift-origin-brokerUpgrade rubygem-openshift-origin-controllerUpgrade openshift-origin-cartridge-ruby | Jun 18, 2018 | Feb 24, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub