Skip to content
Sign in
Not rated

CVE-2022-36885 Jenkins GitHub Plugin 1.34.4 and earlier uses a non-constant time comparison function when checking whether the provided…

Description

Jenkins GitHub Plugin 1.34.4 and earlier uses a non-constant time comparison function when checking whether the provided and computed webhook signatures are equal, allowing attackers to use statistical methods to obtain a valid webhook signature.

Affected products and versions

Product Affected versions Fixed in
Jenkins GitHub Plugin 1.34 earliest → 1.34.4 1.34.3.1

Other CVEs of Jenkins GitHub Plugin

The 3 CVEs of Jenkins GitHub Plugin →
CVE-2026-42523 Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part of JavaScript implementing… 9.0 Critical CVE-2023-46650 Jenkins GitHub Plugin 1.37.3 and earlier does not escape the GitHub project URL on the build page when showing… Not rated
Track this CVE