PT-2019-2638 · Jenkins · Jenkins Token Macro Plugin+1

Daniel Beck · Published 2019-06-11 · Updated 2023-10-25 · CVE-2019-10337

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Jenkins Token Macro Plugin versions 2.7 and earlier

Description The issue is related to an XML external entities (XXE) vulnerability. It allows attackers who can control the content of the input file for the "XML" macro to have Jenkins resolve external entities. This can result in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks.

Recommendations For Jenkins Token Macro Plugin versions 2.7 and earlier, update to a version later than 2.7 to resolve the issue. As a temporary workaround, consider restricting the use of the "XML" macro to minimize the risk of exploitation.

Fix

DoS

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2019-02524

CVE-2019-10337

GHSA-G6H2-4X64-C59X

RHSA-2019:1636

RHSA-2019:1851

Affected Products

Jenkins

Jenkins Token Macro Plugin

References · 11

• https://access.redhat.com/errata/RHSA-2019:1636 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10337 · Security Note
• https://access.redhat.com/errata/RHSA-2019:1851 · Vendor Advisory
• https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1399 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10337 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02524 · Security Note
• https://osv.dev/vulnerability/GHSA-g6h2-4x64-c59x · Vendor Advisory
• https://github.com/jenkinsci/token-macro-plugin · Note
• https://github.com/jenkinsci/token-macro-plugin/commit/004319f1b6e2a0f097a096b9df9dc19a5ac0d9b0 · Note
• http://securityfocus.com/bid/108747 · Note
• http://openwall.com/lists/oss-security/2019/06/11/1 · Note