CVE-2023-41935 Non-constant time nonce comparison in Jenkins Microsoft Entra ID (previously Azure AD) Plugin
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2023-41935?
CVE-2023-41935 is a high-severity vulnerability in Jenkins Azure AD Plugin, published on 6 Sep 2023.
Official description
Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b_1154b_3fb_, uses a non-constant time comparison function when checking whether the provided and expected CSRF protection nonce are equal, potentially allowing attackers to use statistical methods to obtain a valid nonce.
Weakness: CWE-697
Which versions are affected by CVE-2023-41935?
4 open source packages ship an affected version, including org.jenkins-ci.plugins:azure-ad. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:azure-ad Maven | All versions | 378.vd6e2874a |
org.jenkins-ci.plugins:azure-ad Maven | All versions | 378.vd6e2874a |
org.jenkins-ci.plugins:azure-ad Maven | From 378.380.v545b | 397.v907382dd9b |
org.jenkins-ci.plugins:azure-ad Maven | From 378.380.v545b | 397.v907382dd9b |
Products include Jenkins Azure Ad.
How do I fix CVE-2023-41935?
Upgrade org.jenkins-ci.plugins:azure-ad to a fixed version for your release line: 378.vd6e2874a or 397.v907382dd9b.
Is CVE-2023-41935 being exploited?
There is no known exploitation of CVE-2023-41935 in the wild and no public exploit code.
Other vulnerabilities in Jenkins Azure AD Plugin
- CVE-2023-24426 Insufficient Session Expiration in Jenkins Azure AD Plugin
- CVE-2021-21679 Jenkins Azure AD Plugin allows bypassing CSRF protection for any URL
- CVE-2019-10318 Jenkins Azure AD Plugin stored the client secret unencrypted
- CVE-2020-2119 Client secret transmitted in plain text by Azure AD Plugin
- CVE-2026-42525 Jenkins Microsoft Entra ID (previously Azure AD) Plugin has an open redirect vulnerability
Sources
Also known as GHSA-hj7p-h74j-6gxj.