CVE-2020-2102: Medium severity Jenkins Jenkins vulnerability
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier does not use a constant-time comparison when checking whether two HMACs are equal. This could potentially allow attackers to use statistical methods to obtain a valid HMAC for an attacker-controlled input value.
Jenkins 2.219, LTS 2.204.2 now uses a constant-time comparison when validating HMACs.
Other sources
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier used a non-constant time comparison function when validating an HMAC.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.jenkins-ci.main:jenkins-coreto a version that resolves this vulnerability.Fixed in 2.219 - Upgrade
Upgrade
maven/org.jenkins-ci.main:jenkins-coreto a version that resolves this vulnerability.Fixed in 2.204.2
Event History
Frequently Asked Questions
What is the severity of CVE-2020-2102?
CVE-2020-2102 has a medium severity rating due to potential HMAC computation vulnerabilities.
How do I fix CVE-2020-2102?
To resolve CVE-2020-2102, upgrade Jenkins to version 2.219 or LTS version 2.204.2 or later.
What versions of Jenkins are affected by CVE-2020-2102?
CVE-2020-2102 affects Jenkins versions 2.218 and earlier, as well as LTS versions 2.204.1 and earlier.
What could happen if CVE-2020-2102 is exploited?
Exploitation of CVE-2020-2102 could allow attackers to construct valid HMACs for controlled input, leading to unauthorized access.
Is there a way to mitigate CVE-2020-2102 without upgrading?
There are no effective mitigations for CVE-2020-2102 other than upgrading to a secure version.