Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Jenkins GitHub Plugin: Weak Signature Verification Exposes Webhook Secrets

CVE-2022-36885 · published 4 years ago
Summary

A vulnerability in Jenkins GitHub Plugin 1.34.4 and earlier makes it possible for attackers to steal passwords. This is a serious issue because it could allow unauthorized access to your Jenkins server. To fix this, update the plugin to the latest version, at least 1.35.0.

What to do
  • Update coravy com.coravy.hudson.plugins.github:github to version 1.34.5.
Affected software
Ecosystem VendorProductAffected versions
maven coravy com.coravy.hudson.plugins.github:github <= 1.34.4
Fix: upgrade to 1.34.5
– jenkins github <= 1.34.4
cpe:2.3:a:jenkins:github:*:*:*:*:*:jenkins:*:*
Original advisory text
Jenkins GitHub Plugin 1.34.4 and earlier uses a non-constant time comparison function when checking whether the provided and computed webhook signatures are equal, allowing attackers to use statist...
Jenkins GitHub Plugin 1.34.4 and earlier uses a non-constant time comparison function when checking whether the provided and computed webhook signatures are equal, allowing attackers to use statistical methods to obtain a valid webhook signature.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-203Observable Discrepancy
CWE-208Observable Timing Discrepancy
Timeline
Published27 Jul 2022
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-mxcc-7h5m-x57r · GHSA
CVE-2022-36885 · NVD
Track software like this
Free during beta