Skip to content
Sign in
5.3 Medium

CVE-2022-43412 Jenkins Generic Webhook Trigger Plugin 1.84.1 and earlier uses a non-constant time comparison function when checking…

Description

Jenkins Generic Webhook Trigger Plugin 1.84.1 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token.

Affected products and versions

Product Affected versions Fixed in
Jenkins Generic Webhook Trigger Plugin 1.84 earliest → 1.84.1 No fix stated

Other CVEs of Jenkins Generic Webhook Trigger Plugin

The 3 CVEs of Jenkins Generic Webhook Trigger Plugin →
CVE-2022-25185 Jenkins Generic Webhook Trigger Plugin 1.81 and earlier does not escape the build cause when using the webhook,… Not rated CVE-2021-21669 Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity… Not rated
Track this CVE