Improper Neutralization of Special Elements used in an OS Command in Jenkins Git Client Plugin

HIGH 8.8CVE-2019-10392 · GHSA-hw6x-2qwv-rxr7 · Published 12/09/2019 · updated 17/06/2026

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:git-client Maven	`< 2.8.5`	`2.8.5`
git client jenkins	`= 3.0.0≤ 2.8.4`	No fix yet

Description

Jenkins Git Client Plugin 2.8.4 and earlier did not properly restrict values passed as URL argument to an invocation of 'git ls-remote', resulting in OS command injection.

NVD description

Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of 'git ls-remote', resulting in OS command injection.

References

nvd.nist.gov/vuln/detail/CVE-2019-10392 · ADVISORY
jenkinsci/git-client-plugin commit 899123f · WEB
jenkins.io/security/advisory/2019-09-12 · WEB
openwall.com/lists/oss-security/2019/09/12/2 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free