CVE-2020-2102 — Observable Discrepancy in Project Jenkins

CWE-203 — Observable DiscrepancyCWE-385 — Covert Timing ChannelCWE-208 — Observable Timing Discrepancy8 documents7 sources
Severity
5.3MEDIUMNVD
EPSS
1.5%
top 18.70%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins Project JenkinsJenkins
Timeline
PublishedJan 29
Latest updateMay 24

Description

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier used a non-constant time comparison function when validating an HMAC.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.6 | Impact: 3.6

Affected Packages2 packages

▶NVDjenkins/jenkins2.204.1+1
▶CVEListV5jenkins_project/jenkinsunspecified — 2.218+1

🔴Vulnerability Details

3
OSV
Non-constant time HMAC comparison↗2022-05-24
▶
GHSA
Non-constant time HMAC comparison↗2022-05-24
▶
CVEList
CVE-2020-2102: Jenkins 2↗2020-01-29
▶

📋Vendor Advisories

2
Jenkins
Jenkins Security Advisory 2020-01-29↗2020-01-29
▶
Red Hat
jenkins: Non-constant time HMAC comparison↗2020-01-29
▶

💬Community

2
Bugzilla
CVE-2020-2102 jenkins: Non-constant time HMAC comparison [fedora-all]↗2020-01-31
▶
Bugzilla
CVE-2020-2102 jenkins: Non-constant time HMAC comparison↗2020-01-31
▶
CVE-2020-2102 — Observable Discrepancy | cvebase