CVE-2024-23903
Assigner: jenkins
Published: 2024-01-24T17:52:26.696Z
State: PUBLISHED
affected: vendor: Jenkins Project
product: Jenkins GitLab Branch Source Plugin
versions: version: 0
versionType: maven
lessThanOrEqual: 684.vea_fa_7c1e2fe3
status: affected
defaultStatus: unaffected
descriptions: value: Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token.