GHSA-2q8v-qx2x-hxjx
Jenkins allows HTTP Injection and Response Splitting
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2012-6072
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Description
CRLF injection vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
Paquets affectés
| Paquet | Versions |
|---|---|
| Maven · org.jenkins-ci.main:jenkins-core | introduced 1.481, fixed 1.491 |
| Maven · org.jenkins-ci.main:jenkins-core | introduced 0, fixed 1.480.1 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2012-6072 ADVISORY
- https://bugzilla.redhat.com/show_bug.cgi?id=890607 WEB
- https://github.com/jenkinsci/jenkins PACKAGE
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2012-11-20 WEB
- http://rhn.redhat.com/errata/RHSA-2013-0220.html WEB
- http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2012-11-20.cb WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |