GHSA-5r33-mgjf-6656LowCVSS 3.7

Jenkins Tuleap Authentication Plugin non-constant time token comparison

Published
August 16, 2023
Last Modified
November 11, 2023

🔗 CVE IDs covered (1)

CVE-2023-40343 →

📋 Description

Jenkins Tuleap Authentication Plugin 1.1.20 and earlier does not use a constant-time comparison when checking whether two authentication tokens are equal.

This could potentially allow attackers to use statistical methods to obtain a valid authentication token.

Tuleap Authentication Plugin 1.1.21 uses a constant-time comparison when validating authentication tokens.

🎯 Affected products1

  • maven/io.jenkins.plugins:tuleap-oauth:< 1.1.21

🔗 References (4)