CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2020-2101
https://notcve.org/view.php?id=CVE-2020-2101
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier did not use a constant-time comparison function for validating connection secrets, which could potentially allow an attacker to use a timing attack to obtain this secret. Jenkins versiones 2.218 y anteriores, versiones LTS 2.204.1 y anteriores, no usaban una función de comparación de tiempo constante para comprobar secretos de conexión, lo que podría potencialmente permitir a un atacante usar un ataque de sincronización para obtener este secreto. • http://www.openwall.com/lists/oss-security/2020/01/29/1 https://access.redhat.com/errata/RHBA-2020:0402 https://access.redhat.com/errata/RHBA-2020:0675 https://access.redhat.com/errata/RHSA-2020:0681 https://access.redhat.com/errata/RHSA-2020:0683 https://jenkins.io/security/advisory/2020-01-29/#SECURITY-1659 • CWE-203: Observable Discrepancy •
CVSS: 8.6EPSS: 0%CPEs: 2EXPL: 0CVE-2020-2099
https://notcve.org/view.php?id=CVE-2020-2099
Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents, which can be used to connect to Jenkins, impersonating those agents. Jenkins versiones 2.213 y anteriores, versiones LTS 2.204.1 y anteriores, reutilizan inapropiadamente los parámetros de clave de cifrado en el Inbound TCP Agent Protocol/3, permitiendo a atacantes no autorizados con conocimiento de los nombres de los agentes obtener los secretos de conexión para esos agentes, que pueden ser usados para conectar con Jenkins , haciéndose pasar por esos agentes. • http://www.openwall.com/lists/oss-security/2020/01/29/1 https://access.redhat.com/errata/RHBA-2020:0402 https://access.redhat.com/errata/RHBA-2020:0675 https://access.redhat.com/errata/RHSA-2020:0681 https://access.redhat.com/errata/RHSA-2020:0683 https://jenkins.io/security/advisory/2020-01-29/#SECURITY-1682 • CWE-330: Use of Insufficiently Random Values •