Skip to content
OpenAdvisories
Medium · 4.3 CVE-2019-1003010 EUVD-2022-5132GHSA-r8rw-xx57-m64q

Cross-Site Request Forgery in Jenkins Git Plugin

Published Feb 6, 2019 · Updated Aug 5, 2024 · Assigned by jenkins

Package: git Package: org.jenkins-ci.plugins:git Ecosystem: Azure Linux Ecosystem: Maven

Description

A cross-site request forgery vulnerability exists in Jenkins Git Plugin 3.9.1 and earlier in src/main/java/hudson/plugins/git/GitTagAction.java that allows attackers to create a Git tag in a workspace and attach corresponding metadata to a build record.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat OpenShift 3 atomic-enterprise-service-catalog +1 1:3.11.82-1.git.1673.133961e.el7 RHBA-2019:0326
Red Hat OpenShift 3 atomic-openshift +12 3.11.82-1.git.0.08bc31b.el7 RHBA-2019:0326
Red Hat OpenShift 3 atomic-openshift-cluster-autoscaler 3.11.82-1.git.0.efb6af0.el7 RHBA-2019:0326
Red Hat OpenShift 3 atomic-openshift-descheduler 3.11.82-1.git.300.89765c9.el7 RHBA-2019:0326
Red Hat OpenShift 3 atomic-openshift-dockerregistry 3.11.82-1.git.452.0ce6383.el7 RHBA-2019:0326
Red Hat OpenShift 3 atomic-openshift-metrics-server 3.11.82-1.git.52.2fdca3f.el7 RHBA-2019:0326
Red Hat OpenShift 3 atomic-openshift-node-problem-detector 3.11.82-1.git.254.a448936.el7 RHBA-2019:0326
Red Hat OpenShift 3 atomic-openshift-service-idler 3.11.82-1.git.14.e353758.el7 RHBA-2019:0326
Red Hat OpenShift 3 atomic-openshift-web-console 3.11.82-1.git.355.5e8b1d9.el7 RHBA-2019:0326
Red Hat OpenShift 3 golang-github-openshift-oauth-proxy 3.11.82-1.git.425.7cac034.el7 RHBA-2019:0326
Red Hat OpenShift 3 haproxy +1 1.8.17-3.el7 RHBA-2019:0326
Red Hat OpenShift 3 jenkins 2.150.2.1549032159-1.el7 RHBA-2019:0326
Red Hat OpenShift 3 jenkins-2-plugins 3.11.1549642489-1.el7 RHBA-2019:0326
Red Hat OpenShift 3 openshift-ansible +4 3.11.82-3.git.0.9718d0a.el7 RHBA-2019:0326
Red Hat OpenShift 3 openshift-enterprise-autoheal 3.11.82-1.git.219.0b5aff4.el7 RHBA-2019:0326
Red Hat OpenShift 3 openshift-enterprise-cluster-capacity 3.11.82-1.git.380.cf11c51.el7 RHBA-2019:0326
Red Hat OpenShift 3 prometheus +1 3.11.82-1.git.5027.9d24833.el7 RHBA-2019:0326
Red Hat OpenShift 3 prometheus-alertmanager +1 3.11.82-1.git.0.3bf41ce.el7 RHBA-2019:0326
Red Hat OpenShift 3 prometheus-node-exporter +1 3.11.82-1.git.1063.48444e8.el7 RHBA-2019:0326

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 git No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.plugins:git < 3.9.2 3.9.2 GHSA-r8rw-xx57-m64q

Advisories 1

References