Search for packages
| purl | pkg:maven/org.jenkins-ci.main/jenkins-core@2.334 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-vgg4-g95a-gkey
Aliases: CVE-2022-34174 GHSA-9grj-j43m-mjqr |
Observable timing discrepancy allows determining username validity in Jenkins In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm. This allows attackers to determine the validity of attacker-specified usernames. Login attempts with an invalid username now validate a synthetic password to eliminate the timing discrepancy in Jenkins 2.356, LTS 2.332.4. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-wrub-pwdz-qkhz | Deserialization of Untrusted Data Jenkins defines custom XStream converters that have not been updated to apply the protections for the vulnerability CVE-2021-43859 and allow unconstrained resource usage. |
CVE-2022-0538
GHSA-34wx-x2w9-vqm3 |
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-04-01T16:02:42.299344+00:00 | GHSA Importer | Affected by | VCID-vgg4-g95a-gkey | https://github.com/advisories/GHSA-9grj-j43m-mjqr | 38.0.0 |
| 2026-04-01T15:59:45.451918+00:00 | GHSA Importer | Fixing | VCID-wrub-pwdz-qkhz | https://github.com/advisories/GHSA-34wx-x2w9-vqm3 | 38.0.0 |
| 2026-04-01T13:06:27.968367+00:00 | GithubOSV Importer | Fixing | VCID-wrub-pwdz-qkhz | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-34wx-x2w9-vqm3/GHSA-34wx-x2w9-vqm3.json | 38.0.0 |
| 2026-04-01T12:49:25.253368+00:00 | GitLab Importer | Fixing | VCID-wrub-pwdz-qkhz | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.jenkins-ci.main/jenkins-core/CVE-2022-0538.yml | 38.0.0 |