Information Exposure Through Timing Discrepancy in Generic Webhook Trigger - CVE-2022-43412

Vulnerability details

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the affected plugin does not use a constant-time comparison when checking whether the provided and expected webhook token are equal. A remote attacker can gain unauthorized access to sensitive information on the system.

Affected software

How to mitigate CVE-2022-43412

External References

• https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2874
• http://www.openwall.com/lists/oss-security/2022/10/19/3

Related Security Bulletins

• Information disclosure in Jenkins Generic Webhook Trigger plugin