CVE-2022-34174: High severity jenkins lts vulnerability
In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-34174?
CVE-2022-34174 is a vulnerability in Jenkins that allows an observable timing discrepancy on the login form, allowing an attacker to distinguish between login attempts with an invalid username and login attempts with a valid username and wrong password.
What is the severity of CVE-2022-34174?
CVE-2022-34174 has a severity rating of 7.5 (High).
How does CVE-2022-34174 impact Jenkins?
CVE-2022-34174 impacts Jenkins versions 2.355 and earlier LTS 2.332.3 and earlier by allowing an attacker to distinguish between login attempts with different types of credentials.
What is the remedy for CVE-2022-34174?
The remedy for CVE-2022-34174 is to update Jenkins to version 2.356 or later, or LTS to version 2.332.4 or later.
Where can I find more information about CVE-2022-34174?
More information about CVE-2022-34174 can be found at the following references: [CVE Details](https://www.cve.org/CVERecord?id=CVE-2022-34174), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-34174), [Jenkins Security Advisory](https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2566), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2119653), [Red Hat Errata](https://access.redhat.com/errata/RHSA-2023:0697).