GHSA-2q8v-qx2x-hxjx

Jenkins allows HTTP Injection and Response Splitting

At a glance

Published: 2022-05-14 02:13 UTC
Updated: 2025-03-13 18:40 UTC
CVE: CVE-2012-6072
CVSS_V4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Description

CRLF injection vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

Affected packages

Package	Versions
Maven · org.jenkins-ci.main:jenkins-core	introduced 1.481, fixed 1.491
Maven · org.jenkins-ci.main:jenkins-core	introduced 0, fixed 1.480.1

References

https://nvd.nist.gov/vuln/detail/CVE-2012-6072 ADVISORY
https://bugzilla.redhat.com/show_bug.cgi?id=890607 WEB
https://github.com/jenkinsci/jenkins PACKAGE
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2012-11-20 WEB
http://rhn.redhat.com/errata/RHSA-2013-0220.html WEB
http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2012-11-20.cb WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database