CVE-2016-0791 Exposure of Sensitive Information in Jenkins Core
CriticalCVSS 9.8
EPSS 2.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force approach.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.jenkins-ci.main/jenkins-core(Maven) | < 1.650 | 1.650 |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.396 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.397 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.398 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.399 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.400 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.401 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.403 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.404 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.405 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.406 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.407 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.408 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.409 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.409.1 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.409.2 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.409.3 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.410 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.411 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.412 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.413 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.414 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.415 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.416 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.417 | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.418 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.419 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.420 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.421 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.422 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.423 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.424 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.424.1 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.424.2 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.424.3 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.424.4 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.424.5 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.424.6 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.425 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.426 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.427 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.428 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.429 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.430 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.431 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.432 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.433 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.434 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.435 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.436 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.437 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.438 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.439 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.440 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.441 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.442 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.443 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.444 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.445 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.446 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.447 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.447.1 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.447.2 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.448 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.449 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.450 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.451 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.452 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.453 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.454 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.455 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.456 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.457 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.458 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.459 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.460 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.461 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.462 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.463 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.464 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.465 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.466 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.466.1 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.466.2 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.467 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.468 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.469 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.470 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.471 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.472 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.473 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.474 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.475 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.476 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.477 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.478 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.479 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.480 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.480.1 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.480.2 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.480.3 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.481 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.482 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.483 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.484 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.485 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.486 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.487 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.488 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.489 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.490 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.491 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.492 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.493 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.494 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.495 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.496 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.497 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.498 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.499 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.500 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.501 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.502 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.503 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.504 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.505 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.506 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.507 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.508 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.509 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.509.1 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.509.2 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.509.2.JENKINS-14362-jzlib | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.509.2.JENKINS-8856-diag | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.509.3 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.509.3.JENKINS-14362-jzlib | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.509.4 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.510 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.511 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.512 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.513 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.514 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.515 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.516 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.516.JENKINS-14362-jzlib | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.517 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.518 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.518.JENKINS-14362-jzlib | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.519 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.520 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.521 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.522 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.523 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.524 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.525 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.526 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.527 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.528 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.529 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.530 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.531 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.532 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.532.1 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.532.1.JENKINS-19453 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.532.2 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.532.2.JENKINS-21622-diag | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.532.2.JENKINS-22395-diag | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.532.3 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.532.3.JENKINS-22395 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.532.3.JENKINS-22395-2 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.533 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.534 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.535 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.536 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.537 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.538 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.539 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.540 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.541 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.542 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.543 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.544 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.545 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.546 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.547 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.548 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.549 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.550 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.551 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.552 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.553 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.554 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.554.1 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.554.2 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.554.3 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.554.3.JENKINS-18065-ALLRM-all | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.554.3.JENKINS-18065-JENKINS-23945 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.555 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.556 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.557 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- RHSA-2016:0711 vendor-advisory
- wiki.jenkins-ci.org patch vendor-advisory
- RHSA-2016:1773 vendor-advisory
- github.com