A user-supplied regular expression in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier was processed in a way that wasn't interruptible, allowing attackers to have Jenkins evaluate a regular expression without the ability to interrupt this process.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2019/12/17/1 | Mailing List Third Party Advisory |
| https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1651 | Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2019/12/17/1 | Mailing List Third Party Advisory |
| https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1651 | Vendor Advisory |
Configurations
History
21 Nov 2024, 04:30
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.openwall.com/lists/oss-security/2019/12/17/1 - Mailing List, Third Party Advisory | |
| References | () https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1651 - Vendor Advisory |
Information
Published : 2019-12-17 15:15
Updated : 2024-11-21 04:30
NVD link : CVE-2019-16555
Mitre link : CVE-2019-16555
CVE.ORG link : CVE-2019-16555
JSON object : View
Products Affected
jenkins
- build_failure_analyzer
CWE
CWE-400
Uncontrolled Resource Consumption