Observable Time Discrepency Affecting io.jenkins:configuration-as-code package, versions [,1.55.1)
Attack Complexity
Low
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications-
snyk-id
SNYK-JAVA-IOJENKINS-2359024
-
published
23 Jan 2022
-
disclosed
21 Jan 2022
-
credit
Unknown
How to fix?
Upgrade io.jenkins:configuration-as-code to version 1.55.1 or higher.
Overview
io.jenkins:configuration-as-code is a plugin for configuring Jenkins based on human-readable declarative configuration files.
Affected versions of this package are vulnerable to Observable Time Discrepency via a non-constant time comparison function when validating authentication tokens, allowing attackers to use statistical methods to obtain a valid authentication token.