CVE-2020-2101
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier did not use a constant-time comparison function for validating connection secrets, which could pote...
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier did not use a constant-time comparison function for validating connection secrets, which could potentially allow an attacker to use a timing attack to obtain this secret.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
Bitnami
jenkins
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.218.1"}]}]
参照URL
- advisory openwall.com
- advisory jenkins.io
- web access.redhat.com
- web access.redhat.com
- web access.redhat.com
- web access.redhat.com
- web nvd.nist.gov