Description
Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b_1154b_3fb_, uses a non-constant time comparison function when checking whether the provided and expected CSRF protection nonce are equal, potentially allowing attackers to use statistical methods to obtain a valid nonce.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins Project | Jenkins Azure AD Plugin | — | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.plugins:azure-ad | >= 378.380.v545b, < 397.v907382dd9b | 397.v907382dd9b | GHSA-hj7p-h74j-6gxj |
| Maven | org.jenkins-ci.plugins:azure-ad | < 378.vd6e2874a | 378.vd6e2874a | GHSA-hj7p-h74j-6gxj |
Advisories 1
- WID-SEC-2023-2286 Jenkins Plugins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 6, 2023