Jenkins Token Macro Plugin's recursive token expansion results in information disclosure and DoS

高 8.1CVE-2019-1003011 · GHSA-23h9-m55m-c5jp · 06/02/2019 公開 · 17/06/2026 更新

要点

CVE-2019-1003011 は org.jenkins-ci.plugins:token-macro, token macro (jenkins), openshift container platform (redhat) に影響する深刻度「高」 (CVSS 8.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：2.0%（全脆弱性の 81.1% より高い）。
対処：2.6 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.jenkins-ci.plugins:token-macro Maven	`< 2.6`	`2.6`
token macro jenkins	`≤ 2.5`	修正版なし
openshift container platform redhat	`= 3.11`	修正版なし

概要

Jenkins Token Macro Plugin recursively applied token expansion.

This could be used by users able to affect input to token expansion (such as change log messages), to inject additional tokens into the input, which would then be expanded, resulting in information disclosure (for example values of environment variables), or denial of service.

Most tokens have been changed to no longer recursively apply token expansion.

NVD の説明

An information exposure and denial of service vulnerability exists in Jenkins Token Macro Plugin 2.5 and earlier in src/main/java/org/jenkinsci/plugins/tokenmacro/Parser.java, src/main/java/org/jenkinsci/plugins/tokenmacro/TokenMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/AbstractChangesSinceMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ChangesSinceLastBuildMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ProjectUrlMacro.java that allows attackers with the ability to control token macro input (such as SCM changelogs) to define recursive input that results in unexpected macro evaluation.