PT-2020-7166 · Cloudbees+1 · Jenkins Enterprise By Cloudbees+1

Moritz Muehlenhoff · Published 2020-02-24 · Updated 2022-04-23 · CVE-2012-0785

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 1.447 Jenkins LTS versions prior to 1.424.2 Jenkins Enterprise by CloudBees 1.424.x versions prior to 1.424.2.1 Jenkins Enterprise by CloudBees 1.400.x versions prior to 1.400.0.11

Description The issue allows remote attackers to cause a considerable CPU load, also known as the "Hash DoS attack", by exploiting a hash collision attack vulnerability. This could lead to a denial-of-service condition.

Recommendations For Jenkins versions prior to 1.447, update to version 1.447 or later. For Jenkins LTS versions prior to 1.424.2, update to version 1.424.2 or later. For Jenkins Enterprise by CloudBees 1.424.x versions prior to 1.424.2.1, update to version 1.424.2.1 or later. For Jenkins Enterprise by CloudBees 1.400.x versions prior to 1.400.0.11, update to version 1.400.0.11 or later.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2012-0785

GHSA-PCHP-C5W8-47GC

Affected Products

Jenkins

Jenkins Enterprise By Cloudbees

References · 9

• https://security-tracker.debian.org/tracker/CVE-2012-0785 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-0785 · Security Note
• https://jenkins.io/security/advisory/2012-01-12 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pchp-c5w8-47gc · Vendor Advisory
• http://openwall.com/lists/oss-security/2012/01/20/8 · Note
• https://t.me/cibsecurity/10048 · Telegram Post
• https://access.redhat.com/security/cve/cve-2012-0785 · Note
• https://cloudbees.com/jenkins-security-advisory-2012-01-12 · Note
• https://t.me/cvenotify/1174 · Telegram Post