CVE-2020-2101
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier did not use a constant-time comparison function for validating connection secrets, which could pote...
Original description
The description as published by the source.
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier did not use a constant-time comparison function for validating connection secrets, which could potentially allow an attacker to use a timing attack to obtain this secret.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
jenkins
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.218.1"}]}]
References
- advisory openwall.com
- advisory jenkins.io
- web access.redhat.com
- web access.redhat.com
- web access.redhat.com
- web access.redhat.com
- web nvd.nist.gov