Vulnerability: The loadUserByUsername function in hudson/security/HudsonPrivateSecurityRealm.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to determine whether a user exists via vectors related to failed login attempts.
Vulnerability ID: CVE-2014-2064
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/jenkinsci/jenkins
Published: 2014-10-17
File: core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java
Commit message: [FIXED SECURITY-79] Prevent (private security realm) usernames from being guessed.
Commit author: Jesse Glick

Vulnerable version (before fix):
 import java.util.ArrayList; import java.util.Collections; import java.util.List; import java.util.logging.Level; import java.util.logging.Logger;  public Details loadUserByUsername(String username) throws UsernameNotFoundExcept     @Override     protected Details authenticate(String username, String password) throws AuthenticationException {         Details u = loadUserByUsername(username);         if (!u.isPasswordCorrect(password))             throw new BadCredentialsException("Failed to login as "+username);         return u;     } 

Fixed version (after fix):
 import java.util.ArrayList; import java.util.Collections; import java.util.List; import java.util.MissingResourceException; import java.util.ResourceBundle; import java.util.logging.Level; import java.util.logging.Logger;  public Details loadUserByUsername(String username) throws UsernameNotFoundExcept     @Override     protected Details authenticate(String username, String password) throws AuthenticationException {         Details u = loadUserByUsername(username);         if (!u.isPasswordCorrect(password)) {             String message;             try {                 message = ResourceBundle.getBundle("org.acegisecurity.messages").getString("AbstractUserDetailsAuthenticationProvider.badCredentials");             } catch (MissingResourceException x) {                 message = "Bad credentials";             }             throw new BadCredentialsException(message);         }         return u;     } 

Patch:
patch: @@ -78,6 +78,8 @@
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
+import java.util.MissingResourceException;
+import java.util.ResourceBundle;
 import java.util.logging.Level;
 import java.util.logging.Logger;
 
@@ -173,8 +175,15 @@ public Details loadUserByUsername(String username) throws UsernameNotFoundExcept
     @Override
     protected Details authenticate(String username, String password) throws AuthenticationException {
         Details u = loadUserByUsername(username);
-        if (!u.isPasswordCorrect(password))
-            throw new BadCredentialsException("Failed to login as "+username);
+        if (!u.isPasswordCorrect(password)) {
+            String message;
+            try {
+                message = ResourceBundle.getBundle("org.acegisecurity.messages").getString("AbstractUserDetailsAuthenticationProvider.badCredentials");
+            } catch (MissingResourceException x) {
+                message = "Bad credentials";
+            }
+            throw new BadCredentialsException(message);
+        }
         return u;
     }
path: core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java