Non-constant time webhook token comparison in Jenkins GitLab Plugin
Low severity
GitHub Reviewed
Published
Oct 19, 2022
to the GitHub Advisory Database
•
Updated Jan 5, 2024
Package
Affected versions
<= 1.5.35
Patched versions
1.5.36
Description
Published by the National Vulnerability Database
Oct 19, 2022
Published to the GitHub Advisory Database
Oct 19, 2022
Reviewed
Oct 19, 2022
Last updated
Jan 5, 2024
Credits
-
NotMyFault Analyst
GitLab Plugin 1.5.35 and earlier does not use a constant-time comparison when checking whether the provided and expected webhook token are equal.
This could potentially allow attackers to use statistical methods to obtain a valid webhook token.
GitLab Plugin 1.5.36 uses a constant-time comparison when validating the webhook token.
References