GHSA-8p3c-m625-wh83
Jenkins has CRLF Injection Vulnerability in the CLI
At a glance
- Published
- Updated
- CVE
- CVE-2016-0789
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Description
CRLF injection vulnerability in the CLI command documentation in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.jenkins-ci.main:jenkins-core | introduced 1.643, fixed 1.650 |
| Maven · org.jenkins-ci.main:jenkins-core | introduced 0, fixed 1.642.2 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2016-0789 ADVISORY
- https://github.com/jenkinsci/jenkins/commit/f5c51fbad2b62b81dc1e0402aeee058a4a478046 WEB
- https://access.redhat.com/errata/RHSA-2016:0711 WEB
- https://github.com/jenkinsci/jenkins PACKAGE
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-02-24 WEB
- http://rhn.redhat.com/errata/RHSA-2016-1773.html WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |