Skip to content
Sign in
5.3 Medium

CVE-2024-23903 Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier uses a non-constant time comparison function when…

Description

Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token.

Affected products and versions

Product Affected versions Fixed in
Jenkins GitLab Branch Source Plugin Versions not published

Other CVEs of Jenkins GitLab Branch Source Plugin

The 3 CVEs of Jenkins GitLab Branch Source Plugin →
CVE-2024-23902 A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier… 4.3 Medium CVE-2024-23901 Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier unconditionally discovers projects that are shared… 6.5 Medium
Track this CVE