description: Jenkins GitHub Plugin 1.34.4 and earlier uses a non-constant time comparison function when checking whether the provided and computed webhook signatures are equal, allowing attackers to use statistical methods to obtain a valid webhook signature.
affected:
{
product: Jenkins GitHub Plugin
vendor: Jenkins project
versions:
lessThanOrEqual: 1.34.4, status: affected, version: unspecified, versionType: custom
status: unaffected, version: 1.34.3.1
status: unaffected, version: 1.34.1.1
}