Non notée
CVE-2023-46657 Jenkins Gogs Plugin 1.0.15 and earlier uses a non-constant time comparison function when checking whether the provided…
Description
Jenkins Gogs Plugin 1.0.15 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Jenkins Gogs Plugin 1.0 | premières → 1.0.15 | Pas de correctif indiqué |
Autres CVE de Jenkins Gogs Plugin
Les 4 CVE de Jenkins Gogs Plugin →
CVE-2023-40349
Jenkins Gogs Plugin 1.0.15 and earlier improperly initializes an option to secure its webhook endpoint, allowing…
Non notée
CVE-2023-40348
The webhook endpoint in Jenkins Gogs Plugin 1.0.15 and earlier provides unauthenticated attackers information about…
Non notée
CVE-2019-10348
Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins master where they can be…
Non notée