CVE-2023-40343 Jenkins Tuleap Authentication Plugin non-constant time token comparison
Attackers can bypass authentication in the Jenkins Tuleap plugin by exploiting timing side-channels to guess valid tokens, leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-40343?
CVE-2023-40343 is a medium-severity vulnerability in Jenkins Tuleap Authentication Plugin, published on 16 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Jenkins Tuleap Authentication Plugin 1.1.20 and earlier uses a non-constant time comparison function when validating an authentication token allowing attackers to use statistical methods to obtain a valid authentication token.
Weakness: CWE-203
Which versions are affected by CVE-2023-40343?
2 open source packages ship an affected version, including io.jenkins.plugins:tuleap-oauth. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.jenkins.plugins:tuleap-oauth Maven | All versions | 1.1.21 |
io.jenkins.plugins:tuleap-oauth Maven | All versions | 1.1.21 |
Products include Jenkins Tuleap Authentication.
How do I fix CVE-2023-40343?
Upgrade io.jenkins.plugins:tuleap-oauth to 1.1.21 or later.
Is CVE-2023-40343 being exploited?
There is no known exploitation of CVE-2023-40343 in the wild and no public exploit code.
Sources
Also known as GHSA-5r33-mgjf-6656.