Bug 2119653 (CVE-2022-34174)

Summary:	CVE-2022-34174 jenkins: Observable timing discrepancy allows determining username validity
Product:	[Other] Security Response	Reporter:	Avinash Hanwate <ahanwate>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	jburrell, vkumar, ymittal
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	Jenkins 2.356, LTS 2.332.4	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-01-14 20:31:11 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2119640

Description Avinash Hanwate 2022-08-19 05:02:23 UTC

In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm.

https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2566

Comment 5 errata-xmlrpc 2023-01-12 16:47:05 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.8

Via RHSA-2023:0017 https://access.redhat.com/errata/RHSA-2023:0017

Comment 6 Product Security DevOps Team 2023-01-14 20:31:06 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-34174

Comment 7 errata-xmlrpc 2023-02-15 15:43:32 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.10

Via RHSA-2023:0697 https://access.redhat.com/errata/RHSA-2023:0697

Comment 8 errata-xmlrpc 2023-02-22 23:58:55 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.9

Via RHSA-2023:0777 https://access.redhat.com/errata/RHSA-2023:0777