-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from using non-constant time comparison methods (Arrays.equals() and String.equals()) for HMAC validation. The commit diff shows these were replaced with MessageDigest.isEqual(), a constant-time comparison method. Both functions directly handled HMAC validation logic and their insecure implementations matched the vulnerability description. The confidence is high due to direct evidence from the security advisory and patch implementation.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.main:jenkins-core | maven | <= 2.204.1 | 2.204.2 |
| org.jenkins-ci.main:jenkins-core | maven | >= 2.205, <= 2.218 | 2.219 |
JavaJavaOngoing coverage of React2Shell