CVE-2022-43412

Name of the Vulnerable Software and Affected Versions Jenkins Generic Webhook Trigger Plugin versions 1.84.1 and earlier

Description The issue concerns a non-constant time comparison function used when checking the equality of provided and expected webhook tokens. This potentially allows attackers to use statistical methods to obtain a valid webhook token.

Recommendations For Jenkins Generic Webhook Trigger Plugin versions 1.84.1 and earlier, update to version 1.84.2 or later, which uses a constant-time comparison when validating the webhook token.