| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.main:jenkins-core | ≥ 2.334, < 2.356< 2.332.4 | 2.3562.332.4 |
| jenkins | ≤ 2.332.3≤ 2.355 |
In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm. This allows attackers to determine the validity of attacker-specified usernames.
Login attempts with an invalid username now validate a synthetic password to eliminate the timing discrepancy in Jenkins 2.356, LTS 2.332.4.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free