Skip to content
OpenAdvisories
Medium · 5.4 CVE-2019-1003050 EUVD-2022-5011GHSA-qpg9-83fv-x9ch

Improper Neutralization of Input During Web Page Generation in Jenkins

Published Apr 10, 2019 · Updated Aug 5, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Package: jenkins Package: org.jenkins-ci.main:jenkins-core Category: Web / CMS Ecosystem: Alpine Ecosystem: Maven

Description

The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site scripting (XSS) vulnerability exploitable by users with the ability to control job names.

Affected products

VendorProductAffectedFixed
Jenkins project Jenkins 2.171 and earlier, LTS 2.164.1 and earlier —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat OpenShift 3 atomic-enterprise-service-catalog +1 1:3.11.117-1.git.1.376e432.el7 RHBA-2019:1605
Red Hat OpenShift 3 atomic-openshift-cluster-autoscaler 3.11.117-1.git.1.caa79fa.el7 RHBA-2019:1605
Red Hat OpenShift 3 atomic-openshift-descheduler 3.11.117-1.git.1.1635b0a.el7 RHBA-2019:1605
Red Hat OpenShift 3 atomic-openshift-dockerregistry 3.11.117-1.git.1.6a42b08.el7 RHBA-2019:1605
Red Hat OpenShift 3 atomic-openshift-metrics-server 3.11.117-1.git.1.319d58e.el7 RHBA-2019:1605
Red Hat OpenShift 3 atomic-openshift-node-problem-detector 3.11.117-1.git.1.0345fe3.el7 RHBA-2019:1605
Red Hat OpenShift 3 atomic-openshift-service-idler 3.11.117-1.git.1.887bb82.el7 RHBA-2019:1605
Red Hat OpenShift 3 atomic-openshift-web-console 3.11.117-1.git.1.be7a05c.el7 RHBA-2019:1605
Red Hat OpenShift 3 cri-o 1.11.14-1.rhaos3.11.gitd56660e.el7 RHBA-2019:1605
Red Hat OpenShift 3 golang-github-openshift-oauth-proxy 3.11.117-1.git.1.2b006d2.el7 RHBA-2019:1605
Red Hat OpenShift 3 jenkins 2.164.2.1555422716-1.el7 RHBA-2019:1605
Red Hat OpenShift 3 jenkins-2-plugins 3.11.1559667994-1.el7 RHBA-2019:1605
Red Hat OpenShift 3 openshift-ansible +4 3.11.123-1.git.0.db681ba.el7 RHBA-2019:1605
Red Hat OpenShift 3 openshift-enterprise-autoheal 3.11.117-1.git.1.ef32a58.el7 RHBA-2019:1605
Red Hat OpenShift 3 openshift-enterprise-cluster-capacity 3.11.117-1.git.1.6593fce.el7 RHBA-2019:1605
Red Hat OpenShift 3 prometheus +1 3.11.117-1.git.1.f52d417.el7 RHBA-2019:1605
Red Hat OpenShift 3 prometheus-alertmanager +1 3.11.117-1.git.1.207ef35.el7 RHBA-2019:1605
Red Hat OpenShift 3 prometheus-node-exporter +1 3.11.117-1.git.1.dcee33f.el7 RHBA-2019:1605

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.9 jenkins 2.164.2-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.main:jenkins-core < 2.164.2 2.164.2 GHSA-qpg9-83fv-x9ch
Maven org.jenkins-ci.main:jenkins-core >= 2.165, < 2.172 2.172 GHSA-qpg9-83fv-x9ch

Advisories 1

References