CVE-2023-41935

Name
CVE-2023-41935
Description
Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b_1154b_3fb_, uses a non-constant time comparison function when checking whether the provided and expected CSRF protection nonce are equal, potentially allowing attackers to use statistical methods to obtain a valid nonce.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3227
MISC http://www.openwall.com/lists/oss-security/2023/09/06/9

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:jenkins:azure_ad:*:*:*:*:*:jenkins:*:* jenkins >= 378.vd6e2874a_69eb <= 396.v86ce29279947
cpe:2.3:a:jenkins:azure_ad:*:*:*:*:*:jenkins:*:* jenkins >= None <= 348.vefd011eea_20b

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
jenkins edge-community 2.568.1-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
jenkins edge-community 2.555.3-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
jenkins edge-community 2.555.1-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
jenkins edge-community 2.541.3-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
jenkins edge-community 2.541.2-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
jenkins edge-community 2.541.1-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
jenkins edge-community 2.528.3-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
jenkins edge-community 2.516.1-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
jenkins edge-community 2.479.1-r1 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
jenkins edge-community 2.479.1-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
jenkins edge-community 2.361.2-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
jenkins edge-community 2.346.2-r1 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
jenkins edge-community 2.346.2-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
jenkins edge-community 2.332.4-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
jenkins edge-community 2.332.3-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
jenkins edge-community 2.332.2-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
jenkins edge-community 2.332.1-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
jenkins edge-community 2.319.3-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
jenkins edge-community 2.319.2-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
jenkins edge-community 2.287-r0 None possibly vulnerable
jenkins edge-community 2.275-r0 None possibly vulnerable
jenkins edge-community 2.245-r0 None possibly vulnerable
jenkins edge-community 2.228-r0 None possibly vulnerable
jenkins 3.24-community 2.555.1-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
jenkins 3.23-community 2.541.2-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
jenkins 3.23-community 2.516.1-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
jenkins 3.22-community 2.479.1-r1 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
jenkins 3.22-community 2.479.1-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
jenkins 3.22-community 2.361.2-r0 None possibly vulnerable
jenkins 3.22-community 2.346.2-r0 None possibly vulnerable
jenkins 3.22-community 2.332.1-r0 None possibly vulnerable
jenkins 3.22-community 2.319.3-r0 None possibly vulnerable
jenkins 3.22-community 2.319.2-r0 None possibly vulnerable
jenkins 3.22-community 2.287-r0 None possibly vulnerable
jenkins 3.22-community 2.275-r0 None possibly vulnerable
jenkins 3.22-community 2.245-r0 None possibly vulnerable
jenkins 3.22-community 2.228-r0 None possibly vulnerable
jenkins 3.20-community 2.440.2-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
jenkins 3.19-community 2.440.3-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
jenkins 3.18-community 2.387.3-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable