CVE-2022-36885 Jenkins GitHub plugin uses weak webhook signature function
Attackers can bypass webhook signature verification in the Jenkins GitHub Plugin using timing attacks to forge valid signatures.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-36885?
CVE-2022-36885 is a medium-severity vulnerability in Jenkins GitHub Plugin, published on 27 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Jenkins GitHub Plugin 1.34.4 and earlier uses a non-constant time comparison function when checking whether the provided and computed webhook signatures are equal, allowing attackers to use statistical methods to obtain a valid webhook signature.
Weakness: CWE-203
Which versions are affected by CVE-2022-36885?
2 open source packages ship an affected version, including com.coravy.hudson.plugins.github:github. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.coravy.hudson.plugins.github:github Maven | All versions | 1.34.5 |
com.coravy.hudson.plugins.github:github Maven | All versions | 1.34.5 |
Products include Jenkins Github.
How do I fix CVE-2022-36885?
Upgrade com.coravy.hudson.plugins.github:github to 1.34.5 or later.
Is CVE-2022-36885 being exploited?
There is no known exploitation of CVE-2022-36885 in the wild and no public exploit code.
Other vulnerabilities in Jenkins GitHub Plugin
- CVE-2026-42523 Jenkins GitHub Plugin has an XSS vulnerability
- CVE-2018-1000600 CSRF vulnerability and missing permission checks in GitHub Plugin allowed capturing credentials
- CVE-2018-1000183 Jenkins GitHub Plugin exposure of sensitive information vulnerability exists
- CVE-2023-46650 Stored XSS vulnerability in Jenkins GitHub Plugin
- CVE-2018-1000184 Jenkins GitHub Plugin server-side request forgery vulnerability exists
Sources
Also known as GHSA-mxcc-7h5m-x57r.