PT-2022-22041 · Jenkins · Jenkins

Anders Lundman · Published 2022-06-22 · Updated 2024-03-06 · CVE-2022-34174

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.355 and earlier, LTS versions 2.332.3 and earlier

Description The issue is related to an observable timing discrepancy on the login form, which allows distinguishing between login attempts with an invalid username and login attempts with a valid username and wrong password when using the Jenkins user database security realm. This discrepancy enables attackers to determine the validity of attacker-specified usernames.

Recommendations For Jenkins versions 2.355 and earlier, update to version 2.356 or later to eliminate the timing discrepancy. For Jenkins LTS versions 2.332.3 and earlier, update to version 2.332.4 or later to eliminate the timing discrepancy.

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

CWE-208

Related Identifiers

BIT-JENKINS-2022-34174

CVE-2022-34174

GHSA-9GRJ-J43M-MJQR

RHSA-2023:0017

RHSA-2023:0697

RHSA-2023:0777

Affected Products

Jenkins

References · 9

• https://osv.dev/vulnerability/GHSA-9grj-j43m-mjqr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34174 · Security Note
• https://jenkins.io/security/advisory/2022-06-22/#SECURITY-2566 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-34174 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jenkins-2022-34174 · Vendor Advisory
• https://github.com/jenkinsci/jenkins · Note
• https://github.com/jenkinsci/jenkins/commit/957ef5902f2e40b6358e6d10f12b26f9dbd2f75a · Note
• https://t.me/cibsecurity/45038 · Telegram Post
• https://t.me/cvenotify/32358 · Telegram Post