PT-2022-15848 · Jenkins · Jenkins Configuration As Code Plugin+1

James Nord · Published 2022-01-12 · Updated 2023-11-15 · CVE-2022-23106

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Configuration as Code Plugin versions 1.55 and earlier

Description The issue arises from the use of a non-constant time comparison function when validating an authentication token, allowing attackers to potentially use statistical methods to obtain a valid authentication token. This could enable unauthorized access.

Recommendations For Jenkins Configuration as Code Plugin versions 1.55 and earlier, update to version 1.55.1 or later to resolve the issue. For versions prior to 1.54.1, update to version 1.54.1 or later. For versions prior to 1.53.1, update to version 1.53.1 or later. For versions prior to 1.47.1, update to version 1.47.1 or later.

Exploit

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

CWE-208

Related Identifiers

CVE-2022-23106

GHSA-FPJ7-9XM6-8HGR

Affected Products

Jenkins

Jenkins Configuration As Code Plugin

References · 12

• 🔥 https://github.com/CVEProject/cvelist/blob/00bfb5abeecc9f553a2f42954ee540e493498ee9/2022/23xxx/CVE-2022-23106.json · Exploit
• https://jenkins.io/security/advisory/2022-01-12/#SECURITY-2141 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23106 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23106 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fpj7-9xm6-8hgr · Vendor Advisory
• https://github.com/jenkinsci/configuration-as-code-plugin/commit/4f425675edf77d382a6fd10890f1a704ff3b2277 · Note
• https://github.com/jenkinsci/configuration-as-code-plugin · Note
• https://t.me/cvenotify/25606 · Telegram Post
• https://t.me/cvenotify/25323 · Telegram Post
• https://t.me/cibsecurity/35367 · Telegram Post
• http://openwall.com/lists/oss-security/2022/01/12/6 · Note
• https://t.me/cvenotify/25354 · Telegram Post