[Bug 1311948] New: CVE-2016-0790 jenkins: Non-constant time comparison of API token (SECURITY-241)

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1311948

Bug ID: 1311948
           Summary: CVE-2016-0790 jenkins: Non-constant time comparison of
                    API token (SECURITY-241)
           Product: Security Response
         Component: vulnerability
          Keywords: Security
          Severity: high
          Priority: high
          Assignee: [e-mail]
          Reporter: [e-mail]
                CC: [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail]

The following flaw was found in Jenkins:

The verification of user-provided API tokens with the expected value did not
use a constant-time comparison algorithm, potentially allowing attackers to use
statistical methods to determine valid API tokens using brute-force methods.

External References:

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-...

[Bug 1311948] CVE-2016-0790 jenkins: Non-constant time comparison of API token (SECURITY-241)

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1311948

Andrej Nemec  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1311951

[Bug 1311948] CVE-2016-0790 jenkins: Non-constant time comparison of API token (SECURITY-241)

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1311948

Andrej Nemec  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1311952

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1311952
[Bug 1311952] CVE-2016-0788 CVE-2016-0789 CVE-2016-0790 CVE-2016-0791
CVE-2016-0792 jenkins: security advisory 2016-02-24 [fedora-all]

[Bug 1311948] CVE-2016-0790 jenkins: Non-constant time comparison of API token (SECURITY-241)

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1311948
Bug 1311948 depends on bug 1311952, which changed state.

Bug 1311952 Summary: CVE-2016-0788 CVE-2016-0789 CVE-2016-0790 CVE-2016-0791 CVE-2016-0792 jenkins: security advisory 2016-02-24 [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1311952

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ON_QA                       |CLOSED
         Resolution|---                         |ERRATA

[Bug 1311948] CVE-2016-0790 jenkins: Non-constant time comparison of API token (SECURITY-241)

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1311948

Kurt Seifried  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |1320308

[Bug 1311948] CVE-2016-0790 jenkins: Non-constant time comparison of API token (SECURITY-241)

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1311948

Kurt Seifried  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1320309

[Bug 1311948] CVE-2016-0790 jenkins: Non-constant time comparison of API token (SECURITY-241)

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1311948

Kurt Seifried  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1324676
         Depends On|                            |1324677

[Bug 1311948] CVE-2016-0790 jenkins: Non-constant time comparison of API token (SECURITY-241)

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1311948

Kurt Seifried  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |1324911

[Bug 1311948] CVE-2016-0790 jenkins: Non-constant time comparison of API token (SECURITY-241)

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1311948

--- Comment #3 from errata-xmlrpc  ---
This issue has been addressed in the following products:

Red Hat OpenShift Enterprise 3.1

Via RHSA-2016:0711 https://access.redhat.com/errata/RHSA-2016:0711

[Bug 1311948] CVE-2016-0790 jenkins: Non-constant time comparison of API token (SECURITY-241)

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1311948

--- Comment #4 from errata-xmlrpc  ---
This issue has been addressed in the following products:

Red Hat OpenShift Enterprise 2.2

Via RHSA-2016:1773 https://rhn.redhat.com/errata/RHSA-2016-1773.html

[Bug 1311948] CVE-2016-0790 jenkins: Non-constant time comparison of API token (SECURITY-241)

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1311948

Kurt Seifried  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |CLOSED
         Resolution|---                         |ERRATA
        Last Closed|                            |2016-08-25 19:27:57