CVE-2024-23903: Medium severity Jenkins Github Branch Source Jenkins vulnerability
Jenkins GitLab Branch Source Plugin 684.veafa7c1e2fe3 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook token are equal.
This could potentially allow attackers to use statistical methods to obtain a valid webhook token.
GitLab Branch Source Plugin 688.v5fa356ee8520 uses a constant-time comparison function when validating the webhook token.
Other sources
Jenkins GitLab Branch Source Plugin 684.veafa7c1e2fe3 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/io.jenkins.plugins:gitlab-branch-sourceto a version that resolves this vulnerability.Fixed in 688.v5fa
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23903?
CVE-2024-23903 is considered a medium severity vulnerability due to the potential for attackers to exploit it to obtain valid webhook tokens.
How do I fix CVE-2024-23903?
To fix CVE-2024-23903, upgrade the Jenkins GitLab Branch Source Plugin to version 688.v5fa or later.
What does CVE-2024-23903 affect?
CVE-2024-23903 affects Jenkins GitLab Branch Source Plugin versions up to and including 684.vea_fa_7c1e2fe3.
What type of vulnerability is CVE-2024-23903?
CVE-2024-23903 is a cryptographic vulnerability that involves improper comparison of webhook tokens.
Can CVE-2024-23903 be exploited remotely?
Yes, CVE-2024-23903 can potentially be exploited remotely by an attacker using statistical methods to derive valid webhook tokens.