github - ghsa-frgr-c5f2-8qhh

ghsa-frgr-c5f2-8qhh

Vulnerability from github

Published

2023-03-10 21:30

Modified

2024-01-05 16:21

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Summary

Denial of service in Jenkins Core

Details

Jenkins 2.393 and earlier, LTS 2.375.3 and earlier, and prior to LTS 2.387.1 is affected by the Apache Commons FileUpload library’s vulnerability CVE-2023-24998. This library is used to process uploaded files via the Stapler web framework (usually through StaplerRequest#getFile) and MultipartFormDataParser in Jenkins.

This allows attackers to cause a denial of service (DoS) by sending crafted requests to HTTP endpoints processing file uploads.

Jenkins 2.394, LTS 2.375.4, and LTS 2.387.1 limits the number of request parts to be processed to 1000. Specific endpoints receiving only simple form submissions have a lower limit.

Show details on source website

JSON

To clipboard

{
   affected: [
      {
         package: {
            ecosystem: "Maven",
            name: "org.jenkins-ci.main:jenkins-core",
         },
         ranges: [
            {
               events: [
                  {
                     introduced: "2.388",
                  },
                  {
                     fixed: "2.394",
                  },
               ],
               type: "ECOSYSTEM",
            },
         ],
      },
      {
         package: {
            ecosystem: "Maven",
            name: "org.jenkins-ci.main:jenkins-core",
         },
         ranges: [
            {
               events: [
                  {
                     introduced: "0",
                  },
                  {
                     fixed: "2.375.4",
                  },
               ],
               type: "ECOSYSTEM",
            },
         ],
      },
      {
         package: {
            ecosystem: "Maven",
            name: "org.jenkins-ci.main:jenkins-core",
         },
         ranges: [
            {
               events: [
                  {
                     introduced: "2.376",
                  },
                  {
                     fixed: "2.387.1",
                  },
               ],
               type: "ECOSYSTEM",
            },
         ],
      },
   ],
   aliases: [
      "CVE-2023-27900",
   ],
   database_specific: {
      cwe_ids: [
         "CWE-770",
      ],
      github_reviewed: true,
      github_reviewed_at: "2023-03-17T14:44:42Z",
      nvd_published_at: "2023-03-10T21:15:00Z",
      severity: "MODERATE",
   },
   details: "Jenkins 2.393 and earlier, LTS 2.375.3 and earlier, and prior to LTS 2.387.1 is affected by the Apache Commons FileUpload library’s vulnerability CVE-2023-24998. This library is used to process uploaded files via the Stapler web framework (usually through StaplerRequest#getFile) and MultipartFormDataParser in Jenkins.\n\nThis allows attackers to cause a denial of service (DoS) by sending crafted requests to HTTP endpoints processing file uploads.\n\nJenkins 2.394, LTS 2.375.4, and LTS 2.387.1 limits the number of request parts to be processed to 1000. Specific endpoints receiving only simple form submissions have a lower limit.",
   id: "GHSA-frgr-c5f2-8qhh",
   modified: "2024-01-05T16:21:00Z",
   published: "2023-03-10T21:30:19Z",
   references: [
      {
         type: "ADVISORY",
         url: "https://nvd.nist.gov/vuln/detail/CVE-2023-27900",
      },
      {
         type: "WEB",
         url: "https://github.com/jenkinsci/jenkins/commit/b70f4cb5892bd6059a45b5f156f019ce572adb08",
      },
      {
         type: "WEB",
         url: "https://github.com/CVEProject/cvelist/blob/master/2023/27xxx/CVE-2023-27900.json",
      },
      {
         type: "WEB",
         url: "https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-3030",
      },
   ],
   schema_version: "1.4.0",
   severity: [
      {
         score: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
         type: "CVSS_V3",
      },
   ],
   summary: "Denial of service in Jenkins Core",
}

cve-2023-27900

Vulnerability from cvelistv5

Published

2023-03-08 17:14

Modified

2025-02-28 18:43

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in hudson.util.MultipartFormDataParser, allowing attackers to trigger a denial of service.

References

▼	URL	Tags
	https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-3030	vendor-advisory

Impacted products

	Vendor	Product	Version
	Jenkins Project	Jenkins

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T12:23:30.566Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "Jenkins Security Advisory 2023-03-08",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-3030",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  cvssV3_1: {
                     attackComplexity: "LOW",
                     attackVector: "NETWORK",
                     availabilityImpact: "HIGH",
                     baseScore: 7.5,
                     baseSeverity: "HIGH",
                     confidentialityImpact: "NONE",
                     integrityImpact: "NONE",
                     privilegesRequired: "NONE",
                     scope: "UNCHANGED",
                     userInteraction: "NONE",
                     vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                     version: "3.1",
                  },
               },
               {
                  other: {
                     content: {
                        id: "CVE-2023-27900",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-28T18:41:35.247278Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            problemTypes: [
               {
                  descriptions: [
                     {
                        cweId: "CWE-770",
                        description: "CWE-770 Allocation of Resources Without Limits or Throttling",
                        lang: "en",
                        type: "CWE",
                     },
                  ],
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-28T18:43:28.521Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "affected",
               product: "Jenkins",
               vendor: "Jenkins Project",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "2.394",
                     versionType: "maven",
                  },
                  {
                     lessThan: "2.375.*",
                     status: "unaffected",
                     version: "2.375.4",
                     versionType: "maven",
                  },
                  {
                     lessThan: "2.387.*",
                     status: "unaffected",
                     version: "2.387.1",
                     versionType: "maven",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in hudson.util.MultipartFormDataParser, allowing attackers to trigger a denial of service.",
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-10-24T12:49:05.247Z",
            orgId: "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
            shortName: "jenkins",
         },
         references: [
            {
               name: "Jenkins Security Advisory 2023-03-08",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-3030",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "39769cd5-e6e2-4dc8-927e-97b3aa056f5b",
      assignerShortName: "jenkins",
      cveId: "CVE-2023-27900",
      datePublished: "2023-03-08T17:14:49.805Z",
      dateReserved: "2023-03-07T09:35:48.506Z",
      dateUpdated: "2025-02-28T18:43:28.521Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted