Jenkins 2.218 and earlier, LTS 2.204.1 and earlier used a non-constant time comparison function when validating an HMAC.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade jenkinsUpgrade jenkins-lts | Jan 30, 2020 | Jan 29, 2020 |
| Jenkins 2020 01 29 | — | Upgrade Jenkins to the latest versionUpgrade Jenkins LTS to version 2.204.2Upgrade Jenkins to version 2.219Upgrade Jenkins LTS to the latest version | Jan 30, 2020 | Jan 29, 2020 |
| Redhat Openshift | — | Upgrade atomic-enterprise-service-catalogUpgrade openshift-enterprise-cluster-capacityUpgrade atomic-openshift-deschedulerUpgrade atomic-openshift-node-problem-detectorUpgrade atomic-openshiftUpgrade cri-oUpgrade jenkins-2-pluginsUpgrade golang-github-prometheus-prometheusUpgrade atomic-openshift-metrics-serverUpgrade openshift-ansibleUpgrade atomic-openshift-web-consoleUpgrade golang-github-openshift-oauth-proxyUpgrade atomic-openshift-cluster-autoscalerUpgrade atomic-openshift-dockerregistryUpgrade atomic-openshift-service-idlerUpgrade golang-github-prometheus-alertmanagerUpgrade jenkinsUpgrade openshift-enterprise-autohealUpgrade golang-github-prometheus-node_exporterUpgrade openshift-kuryr | Mar 18, 2020 | Jan 29, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub