Alpine/jenkins: high 7.5
In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with
Action: Upgrade jenkins to 2.346.2-r0 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.346.2-r0 | - |
Fixed versions
| 2.346.2-r0 |
Sources
- osv: ALPINE-CVE-2022-34174#Alpine:v3.18/jenkins
- https://security.alpinelinux.org/vuln/CVE-2022-34174
published · modified · JSON