CVE-2023-40343: Jenkins Tuleap Authentication Plugin non-constant time token comparison
Summary
CVE-2023-40343: Jenkins Tuleap Authentication Plugin non-constant time token comparison. Affects io.jenkins.plugins:tuleap-oauth versions < 1.1.21. Fixed in 1.1.21. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Tuleap Authentication Plugin is a plugin for the Jenkins automation server that allows users to authenticate using Tuleap, an open-source software development platform. This plugin integrates Jenkins with Tuleap, providing seamless authentication for Tuleap users. The plugin uses authentication tokens to verify the identity of users. However, versions 1.1.20 and earlier of the plugin do not use a constant-time comparison when checking whether two authentication tokens are equal. This vulnerability could potentially allow attackers to use statistical methods to obtain a valid authentication token.
Vulnerability Detail
The vulnerability in the Jenkins Tuleap Authentication Plugin arises from the lack of a constant-time comparison when validating authentication tokens. This means that the time taken to compare two tokens may vary depending on the number of characters that match. Attackers could exploit this vulnerability by using statistical methods to determine the correct token. If successful, they could impersonate legitimate users and gain unauthorized access to Jenkins and any associated resources. The impact of this vulnerability is considered low, with a CVSS score of 3.7.
How To Fix
Latest published version: 1.1.21 as of 22 Oct 2026
The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Users are advised to upgrade to the latest version of the Tuleap Authentication Plugin as soon as possible.
Conclusion
The Jenkins Tuleap Authentication Plugin is vulnerable to a non-constant time token comparison issue, which could allow attackers to obtain valid authentication tokens. Users are advised to upgrade to version 1.1.21 or later of the plugin to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.jenkins.plugins:tuleap-oauth →
FAQ
The Jenkins Tuleap Authentication Plugin is a plugin for the Jenkins automation server that allows users to authenticate using Tuleap, an open-source software development platform.
This vulnerability could potentially allow attackers to obtain a valid authentication token and impersonate legitimate users, gaining unauthorized access to Jenkins and associated resources.
A constant-time comparison is a method of comparing two values that takes the same amount of time regardless of the number of characters that match. This helps prevent attackers from using statistical methods to determine the correct value.
The CVSS score of this vulnerability is 3.7, indicating a low impact.
To fix this vulnerability, users should upgrade to version 1.1.21 or later of the Tuleap Authentication Plugin.
