PT-2016-4415 · Cloudbees+1 · Jenkins

Seung-Hyun Cho · Publicado 2016-04-07 · Atualizado 2022-05-14 · CVE-2016-0789

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 1.650 Jenkins LTS versions prior to 1.642.2

Description The issue allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks.

Recommendations For Jenkins versions prior to 1.650, update to version 1.650 or later. For Jenkins LTS versions prior to 1.642.2, update to version 1.642.2 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-113

CWE-20

Identificadores relacionados

CVE-2016-0789

GHSA-8P3C-M625-WH83

RHSA-2016:0711

RHSA-2016:1773

Produtos afetados

Jenkins

Referências · 8

• https://github.com/jenkinsci/jenkins · Nota
• https://github.com/jenkinsci/jenkins/commit/f5c51fbad2b62b81dc1e0402aeee058a4a478046 · Nota
• https://osv.dev/vulnerability/CVE-2016-0789 · Aviso do Fabricante
• https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-02-24 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2016:0711 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-0789 · Nota de Segurança
• http://rhn.redhat.com/errata/RHSA-2016-1773.html · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-8p3c-m625-wh83 · Aviso do Fabricante