Description
Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to cause a denial of service via a crafted payload.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 1 | jenkins | 1.502-1.el6op | RHSA-2013:0638 |
| Red Hat OpenShift 1 | openshift-origin-cartridge-jenkins-1.4 | 1.0.3-1.el6op | RHSA-2013:0638 |
| Red Hat OpenShift 1 | ruby193-rubygem-rack | 1:1.4.1-4.el6 | RHSA-2013:0638 |
| Red Hat OpenShift 1 | rubygem-rack | 1:1.3.0-4.el6op | RHSA-2013:0638 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | >= 1.481, < 1.502 | 1.502 | GHSA-5c56-g5cq-4gj9 |
| Maven | org.jenkins-ci.main:jenkins-core | < 1.480.3 | 1.480.3 | GHSA-5c56-g5cq-4gj9 |
Advisories 1
- RHSA-2013:0638 Red Hat Security Advisory: Red Hat OpenShift Enterprise 1.1.2 update Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=914879
- RHSA-2013:0638 vendor-advisory
- [oss-security] 20130220 Re: Jenkins CVE request for Jenkins Security Advisory 2013-02-16 mailing-list
- 57994 vdb-entry
- http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-02-16.cb
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16