medium5.9
CVE-2023-40343
Jenkins Tuleap Authentication Plugin non-constant time token comparison
Impact
Jenkins Tuleap Authentication Plugin 1.1.20 and earlier does not use a constant-time comparison when checking whether two authentication tokens are equal. This could potentially allow attackers to use statistical methods to obtain a valid authentication token. Tuleap Authentication Plugin 1.1.21 uses a constant-time comparison when validating authentication tokens.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | io.jenkins.plugins:tuleap-oauth | < 1.1.21 | 1.1.21 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Tuleap Authentication | through 1.1.20 |