CVE-2022-34174
Fixed in a distro release EPSS 2%
In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm.
Products: Jenkins project Jenkins
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | 2.356 |
| Maven | org.jenkins-ci.main:jenkins-core | 2.332.4 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat openshift 4.10 | jenkins | 0:2.361.1.1675406172-1.el8 |
| Red Hat openshift 4.10 | jenkins-2-plugins | 0:4.10.1675407676-1.el8 |
| Red Hat openshift 4.8 | jenkins | 0:2.361.1.1672840472-1.el8 |
| Red Hat openshift 4.8 | jenkins-2-plugins | 0:4.8.1672842762-1.el8 |
| Red Hat openshift 4.9 | jenkins | 0:2.361.1.1675668150-1.el8 |
| Red Hat openshift 4.9 | jenkins-2-plugins | 0:4.9.1675668922-1.el8 |