CVE-2019-10334

Опубликовано: 11 июн. 2019

Источник: nvd

CVSS3: 6.5

CVSS2: 5.8

EPSS Низкий

Описание

Jenkins ElectricFlow Plugin 1.1.5 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM when MultipartUtility.java is used to upload files.

Ссылки

http://www.openwall.com/lists/oss-security/2019/06/11/1
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/108747
https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1411
Vendor Advisory
http://www.openwall.com/lists/oss-security/2019/06/11/1
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/108747
https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1411
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:jenkins:electricflow:*:*:*:*:*:jenkins:*:*

Версия до 1.1.5 (включая)

EPSS

Процентиль: 17%

0.00055

Низкий

6.5 Medium

CVSS3

5.8 Medium

CVSS2

Дефекты

CWE-295

Связанные уязвимости

GHSA-xmqv-pfw7-qmj7