-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from using Apache Commons' StringUtils.equals() in the signature comparison logic. This method performs a non-constant time comparison by exiting early when mismatched characters are found, creating observable timing discrepancies. The commit diff shows replacement with MessageDigest.isEqual() which performs constant-time comparison. The CWE-208 (Timing Discrepancy) classification and GitHub advisory both confirm this was the root cause.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.coravy.hudson.plugins.github:github | maven | <= 1.34.4 | 1.34.5 |