CVE-2020-2101 — Vulnetix

CVE-2020-2101 PUBLISHED

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier did not use a constant-time comparison function for validating connection secrets, which could potentially allow an attacker to use a timing attack to obtain this secret.

EPSS 1.65% · 82.3th percentile

Risk Scores

EPSS Score

1.65%

82.3th percentile

Affected Products

Vendor	Product	Versions
Bitnami	jenkins	0
Bitnami	jenkins	0

Exploit Intelligence

https://jenkins.io/security/advisory/2020-01-29/#SECURITY-1659 (circl)
[oss-security] 20200129 Multiple vulnerabilities in Jenkins and Jenkins plugins (circl)
RHSA-2020:0681 (circl)
RHSA-2020:0683 (circl)
RHBA-2020:0402 (circl)
RHBA-2020:0675 (circl)

Timeline

Jan 29, 2020 CVE Published
Mar 17, 2020 CVE Updated
Apr 14, 2021 EPSS Score
Jan 6, 2022 EPSS Score
Apr 1, 2022 EPSS Score
Mar 7, 2023 EPSS Score
Mar 17, 2025 EPSS Score
Mar 30, 2025 EPSS Score
May 5, 2025 EPSS Score
Jun 1, 2025 EPSS Score
Jun 6, 2025 EPSS Score
Jun 24, 2025 EPSS Score

References

http://www.openwall.com/lists/oss-security/2020/01/29/1 url
https://access.redhat.com/errata/RHBA-2020:0402 url
https://access.redhat.com/errata/RHBA-2020:0675 url
https://access.redhat.com/errata/RHSA-2020:0681 url
https://access.redhat.com/errata/RHSA-2020:0683 url
https://jenkins.io/security/advisory/2020-01-29/#SECURITY-1659 url
https://nvd.nist.gov/vuln/detail/CVE-2020-2101 url

Open in Interactive Console →