CVE-2019-1003011

Опубликовано: 06 фев. 2019

Источник: nvd

CVSS3: 8.1

CVSS2: 5.5

EPSS Низкий

Описание

An information exposure and denial of service vulnerability exists in Jenkins Token Macro Plugin 2.5 and earlier in src/main/java/org/jenkinsci/plugins/tokenmacro/Parser.java, src/main/java/org/jenkinsci/plugins/tokenmacro/TokenMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/AbstractChangesSinceMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ChangesSinceLastBuildMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ProjectUrlMacro.java that allows attackers with the ability to control token macro input (such as SCM changelogs) to define recursive input that results in unexpected macro evaluation.

Ссылки

https://access.redhat.com/errata/RHBA-2019:0326
Third Party Advisory
https://access.redhat.com/errata/RHBA-2019:0327
Third Party Advisory
https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1102
Vendor Advisory
https://access.redhat.com/errata/RHBA-2019:0326
Third Party Advisory
https://access.redhat.com/errata/RHBA-2019:0327
Third Party Advisory
https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1102
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:jenkins:token_macro:*:*:*:*:*:jenkins:*:*

Версия до 2.5 (включая)

Конфигурация 2

cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*

EPSS

Процентиль: 68%

0.00589

Низкий

8.1 High

CVSS3

5.5 Medium

CVSS2

Дефекты

CWE-674

Связанные уязвимости

CVE-2019-1003011

CVSS3: 7.1

redhat

больше 6 лет назад

GHSA-23h9-m55m-c5jp

CVSS3: 6.5

github

около 3 лет назад

Jenkins Token Macro Plugin's recursive token expansion results in information disclosure and DoS