ghsa-23h9-m55m-c5jp
Vulnerability from github
Published
2022-05-13 01:15
Modified
2023-10-25 23:16
Severity
Summary
Jenkins Token Macro Plugin's recursive token expansion results in information disclosure and DoS
Details
Jenkins Token Macro Plugin recursively applied token expansion.
This could be used by users able to affect input to token expansion (such as change log messages), to inject additional tokens into the input, which would then be expanded, resulting in information disclosure (for example values of environment variables), or denial of service.
Most tokens have been changed to no longer recursively apply token expansion.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.5"
},
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:token-macro"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-1003011"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": true,
"github_reviewed_at": "2023-10-25T23:16:02Z",
"nvd_published_at": "2019-02-06T16:29:00Z",
"severity": "MODERATE"
},
"details": "Jenkins Token Macro Plugin recursively applied token expansion.\n\nThis could be used by users able to affect input to token expansion (such as change log messages), to inject additional tokens into the input, which would then be expanded, resulting in information disclosure (for example values of environment variables), or denial of service.\n\nMost tokens have been changed to no longer recursively apply token expansion.",
"id": "GHSA-23h9-m55m-c5jp",
"modified": "2023-10-25T23:16:02Z",
"published": "2022-05-13T01:15:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1003011"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/token-macro-plugin/commit/70163600031ea8d43833e6eea928f8fa2e44f96a"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHBA-2019:0326"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHBA-2019:0327"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1102"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Jenkins Token Macro Plugin\u0027s recursive token expansion results in information disclosure and DoS"
}
Loading...