vulnerability

Jenkins Advisory 2024-01-24: CVE-2024-23903: Non-constant time webhook token comparison in GitLab Branch Source Plugin

Severity
5
CVSS
(AV:N/AC:L/Au:N/C:P/I:N/A:N)
Published
Jan 25, 2024
Added
Jan 25, 2024
Modified
Jan 28, 2025

Description

Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token.

Solution(s)

jenkins-lts-upgrade-2_426_3jenkins-upgrade-2_442
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.