Описание
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not limit sizes provided as query parameters to graph-rendering URLs, allowing attackers to request crafted URLs that use all available memory in Jenkins, potentially leading to out of memory errors.
Ссылки
- Vendor Advisory
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 2.263.1 (включая)Версия до 2.274 (включая)
Одно из
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*
cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*
EPSS
Процентиль: 56%
0.00332
Низкий
6.5 Medium
CVSS3
4 Medium
CVSS2
Дефекты
CWE-770
Связанные уязвимости
CVSS3: 6.5
redhat
около 5 лет назад
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not limit sizes provided as query parameters to graph-rendering URLs, allowing attackers to request crafted URLs that use all available memory in Jenkins, potentially leading to out of memory errors.
CVSS3: 6.5
debian
около 5 лет назад
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not limit size ...
CVSS3: 6.5
github
больше 3 лет назад
Excessive memory allocation in graph URLs leads to denial of service in Jenkins
EPSS
Процентиль: 56%
0.00332
Низкий
6.5 Medium
CVSS3
4 Medium
CVSS2
Дефекты
CWE-770