Lucene search

GoogleOSV:GHSA-9CJV-93G7-C6MV

HistoryMay 13, 2022 - 1:48 a.m.

Loop with Unreachable Exit Condition in Jenkins

2022-05-1301:48:40

Google

osv.dev

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

0.002 Low

EPSS

Percentile

52.1%

JSON

A denial of service vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in CronTab.java that allows attackers with Overall/Read permission to have a request handling thread enter an infinite loop.

CPENameOperatorVersion
org.jenkins-ci.main:jenkins-coreeq2.60.3
org.jenkins-ci.main:jenkins-coreeq1.500
org.jenkins-ci.main:jenkins-coreeq1.571
org.jenkins-ci.main:jenkins-coreeq2.118
org.jenkins-ci.main:jenkins-coreeq1.622
org.jenkins-ci.main:jenkins-coreeq2.75
org.jenkins-ci.main:jenkins-coreeq2.140
org.jenkins-ci.main:jenkins-coreeq1.596.1
org.jenkins-ci.main:jenkins-coreeq1.510
org.jenkins-ci.main:jenkins-coreeq1.616

Name	Operator	Version
org.jenkins-ci.main:jenkins-core	eq	2.60.3
org.jenkins-ci.main:jenkins-core	eq	1.500
org.jenkins-ci.main:jenkins-core	eq	1.571
org.jenkins-ci.main:jenkins-core	eq	2.118
org.jenkins-ci.main:jenkins-core	eq	1.622
org.jenkins-ci.main:jenkins-core	eq	2.75
org.jenkins-ci.main:jenkins-core	eq	2.140
org.jenkins-ci.main:jenkins-core	eq	1.596.1
org.jenkins-ci.main:jenkins-core	eq	1.510
org.jenkins-ci.main:jenkins-core	eq	1.616

Rows per page:

1-10 of 5181

References

www.securityfocus.com/bid/106176

access.redhat.com/errata/RHBA-2019:0024

github.com/jenkinsci/jenkins

github.com/jenkinsci/jenkins/commit/73afa0ca786a87f05b5433e2e38f863826fcad17

jenkins.io/security/advisory/2018-12-05/#SECURITY-1193

nvd.nist.gov/vuln/detail/CVE-2018-1000864

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

0.002 Low

EPSS

Percentile

52.1%

JSON

Related for OSV:GHSA-9CJV-93G7-C6MV