Jenkins 2.218 and earlier, LTS 2.204.1 and earlier did not use a constant-time comparison function for validating connection secrets, which could potentially allow an attacker to use a timing attack to obtain this secret.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| org.jenkins-ci.main:jenkins-core(Maven) | 0 | 2.204.2 | N/A |
| org.jenkins-ci.main:jenkins-core(Maven) | 2.205 | 2.219 | N/A |
CVSS Metrics
