Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify API tokens, which makes it easier for remote attackers to determine API tokens via a brute-force approach.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Jenkins 2016 02 24 | — | Upgrade Jenkins LTS to version 1.642.2Upgrade Jenkins LTS to the latest versionUpgrade Jenkins to version 1.650Upgrade Jenkins to the latest version | Nov 13, 2017 | Apr 7, 2016 |
| Redhat Openshift | — | Upgrade openshift-origin-cartridge-nodejsUpgrade ImageMagickUpgrade jenkinsUpgrade rubygem-openshift-origin-frontend-haproxy-sni-proxyUpgrade openshift-origin-cartridge-jbossewsUpgrade openshift-origin-cartridge-diyUpgrade openshift-origin-cartridge-pythonUpgrade openshift-origin-msg-node-mcollectiveUpgrade rubygem-openshift-origin-nodeUpgrade rubygem-openshift-origin-msg-broker-mcollectiveUpgrade openshift-origin-cartridge-mysqlUpgrade jenkins-plugin-credentialsUpgrade jenkins-plugin-durable-taskUpgrade openshift-origin-node-proxyUpgrade rhcUpgrade openshift-origin-cartridge-phpUpgrade openshift-origin-cartridge-jenkins-clientUpgrade rubygem-openshift-origin-controllerUpgrade rubygem-openshift-origin-admin-consoleUpgrade openshift-origin-cartridge-jenkinsUpgrade openshift-origin-broker-utilUpgrade openshift-origin-cartridge-jbosseapUpgrade libcgroupUpgrade openshift-origin-cartridge-rubyUpgrade jenkins-plugin-kubernetesUpgrade openshift-origin-cartridge-perlUpgrade openshift-origin-cartridge-haproxyUpgrade activemqUpgrade openshift-origin-brokerUpgrade openshift-origin-cartridge-cronUpgrade jenkins-plugin-openshift-pipelineUpgrade rubygem-openshift-origin-routing-daemonUpgrade openshift-origin-node-utilUpgrade openshift-origin-cartridge-mongodb | Jun 18, 2018 | Feb 24, 2016 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub