Tuleap Authentication Plugin up to 1.1.20 on Jenkins Authentication Token timing discrepancy

Summaryinfo

A vulnerability was found in Tuleap Authentication Plugin up to 1.1.20 on Jenkins and classified as critical. The impacted element is an unknown function of the component Authentication Token Handler. Such manipulation leads to timing discrepancy. This vulnerability is uniquely identified as CVE-2023-40343. No exploit exists.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Tuleap Authentication Plugin up to 1.1.20 on Jenkins (Jenkins Plugin). Affected by this issue is an unknown code of the component Authentication Token Handler. The manipulation with an unknown input leads to a timing discrepancy vulnerability. Using CWE to declare the problem leads to CWE-208. Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not. Impacted is confidentiality. CVE summarizes:

Jenkins Tuleap Authentication Plugin 1.1.20 and earlier uses a non-constant time comparison function when validating an authentication token allowing attackers to use statistical methods to obtain a valid authentication token.

The weakness was disclosed 08/16/2023. The advisory is shared for download at jenkins.io. This vulnerability is handled as CVE-2023-40343 since 08/14/2023. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1592.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Jenkins Plugin

Name

• Tuleap Authentication Plugin

Version

• 1.1.0
• 1.1.1
• 1.1.2
• 1.1.3
• 1.1.4
• 1.1.5
• 1.1.6
• 1.1.7
• 1.1.8
• 1.1.9
• 1.1.10
• 1.1.11
• 1.1.12
• 1.1.13
• 1.1.14
• 1.1.15
• 1.1.16
• 1.1.17
• 1.1.18
• 1.1.19
• 1.1.20

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion