CVE-2020-2101: Medium severity Jenkins Jenkins vulnerability
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier did not use a constant-time comparison function for validating connection secrets, which could potentially allow an attacker to use a timing attack to obtain this secret.
Other sources
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier does not use a constant-time comparison validating the connection secret when an inbound TCP agent connection is initiated. This could potentially allow attackers to use statistical methods to obtain the connection secret.
Jenkins 2.219, LTS 2.204.2 now uses a constant-time comparison function for verifying connection secrets.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.jenkins-ci.main:jenkins-coreto a version that resolves this vulnerability.Fixed in 2.219 - Upgrade
Upgrade
maven/org.jenkins-ci.main:jenkins-coreto a version that resolves this vulnerability.Fixed in 2.204.2
Event History
Frequently Asked Questions
What is the severity of CVE-2020-2101?
CVE-2020-2101 is considered a medium severity vulnerability.
How do I fix CVE-2020-2101?
To fix CVE-2020-2101, upgrade Jenkins to version 2.219 or later, or to 2.204.2 if using LTS.
What impact does CVE-2020-2101 have on Jenkins?
CVE-2020-2101 can potentially allow attackers to perform timing attacks to reveal connection secrets.
Which versions of Jenkins are affected by CVE-2020-2101?
Jenkins versions 2.218 and earlier, as well as LTS versions 2.204.1 and earlier, are affected by CVE-2020-2101.
Is there a workaround for CVE-2020-2101?
There are no specific workarounds for CVE-2020-2101 other than upgrading to a secure version.