CVE-2023-46657

Name of the Vulnerable Software and Affected Versions Jenkins Gogs Plugin versions 1.0.15 and earlier

Description The issue is related to the use of a non-constant time comparison function when checking the equality of provided and expected webhook tokens. This potentially allows attackers to use statistical methods to obtain a valid webhook token, leading to unauthorized access to protected information.

Recommendations For Jenkins Gogs Plugin versions 1.0.15 and earlier, as a temporary workaround, consider disabling the webhook token comparison function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.