Skip to content
OpenAdvisories
Medium · 6.5 CVE-2019-1003011 EUVD-2022-1893GHSA-23h9-m55m-c5jp

Jenkins Token Macro Plugin's recursive token expansion results in information disclosure and DoS

Published Feb 6, 2019 · Updated Aug 5, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Token Macro Plugin Package: org.jenkins-ci.plugins:token-macro Category: Web / CMS Ecosystem: Maven

Description

An information exposure and denial of service vulnerability exists in Jenkins Token Macro Plugin 2.5 and earlier in src/main/java/org/jenkinsci/plugins/tokenmacro/Parser.java, src/main/java/org/jenkinsci/plugins/tokenmacro/TokenMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/AbstractChangesSinceMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ChangesSinceLastBuildMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ProjectUrlMacro.java that allows attackers with the ability to control token macro input (such as SCM changelogs) to define recursive input that results in unexpected macro evaluation.

Affected products

VendorProductAffectedFixed
Jenkins project Jenkins Token Macro Plugin 2.5 and earlier —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat OpenShift 3 atomic-enterprise-service-catalog +1 1:3.11.82-1.git.1673.133961e.el7 RHBA-2019:0326
Red Hat OpenShift 3 atomic-openshift +12 3.11.82-1.git.0.08bc31b.el7 RHBA-2019:0326
Red Hat OpenShift 3 atomic-openshift-cluster-autoscaler 3.11.82-1.git.0.efb6af0.el7 RHBA-2019:0326
Red Hat OpenShift 3 atomic-openshift-descheduler 3.11.82-1.git.300.89765c9.el7 RHBA-2019:0326
Red Hat OpenShift 3 atomic-openshift-dockerregistry 3.11.82-1.git.452.0ce6383.el7 RHBA-2019:0326
Red Hat OpenShift 3 atomic-openshift-metrics-server 3.11.82-1.git.52.2fdca3f.el7 RHBA-2019:0326
Red Hat OpenShift 3 atomic-openshift-node-problem-detector 3.11.82-1.git.254.a448936.el7 RHBA-2019:0326
Red Hat OpenShift 3 atomic-openshift-service-idler 3.11.82-1.git.14.e353758.el7 RHBA-2019:0326
Red Hat OpenShift 3 atomic-openshift-web-console 3.11.82-1.git.355.5e8b1d9.el7 RHBA-2019:0326
Red Hat OpenShift 3 golang-github-openshift-oauth-proxy 3.11.82-1.git.425.7cac034.el7 RHBA-2019:0326
Red Hat OpenShift 3 haproxy +1 1.8.17-3.el7 RHBA-2019:0326
Red Hat OpenShift 3 jenkins 2.150.2.1549032159-1.el7 RHBA-2019:0326
Red Hat OpenShift 3 jenkins-2-plugins 3.11.1549642489-1.el7 RHBA-2019:0326
Red Hat OpenShift 3 openshift-ansible +4 3.11.82-3.git.0.9718d0a.el7 RHBA-2019:0326
Red Hat OpenShift 3 openshift-enterprise-autoheal 3.11.82-1.git.219.0b5aff4.el7 RHBA-2019:0326
Red Hat OpenShift 3 openshift-enterprise-cluster-capacity 3.11.82-1.git.380.cf11c51.el7 RHBA-2019:0326
Red Hat OpenShift 3 prometheus +1 3.11.82-1.git.5027.9d24833.el7 RHBA-2019:0326
Red Hat OpenShift 3 prometheus-alertmanager +1 3.11.82-1.git.0.3bf41ce.el7 RHBA-2019:0326
Red Hat OpenShift 3 prometheus-node-exporter +1 3.11.82-1.git.1063.48444e8.el7 RHBA-2019:0326

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.plugins:token-macro < 2.6 2.6 GHSA-23h9-m55m-c5jp

Advisories 1

References