CVE-2024-23903

Name of the Vulnerable Software and Affected Versions Jenkins GitLab Branch Source Plugin versions 684.vea fa 7c1e2fe3 and earlier

Description The issue is related to the use of a non-constant time comparison function when checking whether the provided and expected webhook token are equal. This potentially allows attackers to use statistical methods to obtain a valid webhook token, which could lead to unauthorized access to confidential information.

Recommendations For Jenkins GitLab Branch Source Plugin versions 684.vea fa 7c1e2fe3 and earlier, update to a version that uses a constant-time comparison function, such as version 688.v5fa 356ee8520, to prevent attackers from obtaining a valid webhook token using statistical methods.