CVE-2017-1000092
Fixed in a distro release EPSS <1%
Git Plugin connects to a user-specified Git repository as part of form validation. An attacker with no direct access to Jenkins but able to guess at a username/password credentials ID could trick a developer with job configuration permissions into following a link with a maliciously crafted Jenkins URL which would result in the Jenkins Git client sending the username and password to an attacker-controlled server.
Products: jenkins git
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.jenkins-ci.plugins:git | 3.3.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat openshift 3.6 | atomic-openshift | 0:3.6.173.0.21-1.git.0.f95b0e7.el7 |
| Red Hat openshift 3.6 | atomic-openshift-clients | 0:3.6.173.0.21-1.git.0.f95b0e7.el7 |
| Red Hat openshift 3.6 | atomic-openshift-clients-redistributable | 0:3.6.173.0.21-1.git.0.f95b0e7.el7 |
| Red Hat openshift 3.6 | atomic-openshift-cluster-capacity | 0:3.6.173.0.21-1.git.0.f95b0e7.el7 |
| Red Hat openshift 3.6 | atomic-openshift-docker-excluder | 0:3.6.173.0.21-1.git.0.f95b0e7.el7 |
| Red Hat openshift 3.6 | atomic-openshift-dockerregistry | 0:3.6.173.0.21-1.git.0.f95b0e7.el7 |
| Red Hat openshift 3.6 | atomic-openshift-excluder | 0:3.6.173.0.21-1.git.0.f95b0e7.el7 |
| Red Hat openshift 3.6 | atomic-openshift-federation-services | 0:3.6.173.0.21-1.git.0.f95b0e7.el7 |
| Red Hat openshift 3.6 | atomic-openshift-master | 0:3.6.173.0.21-1.git.0.f95b0e7.el7 |
| Red Hat openshift 3.6 | atomic-openshift-node | 0:3.6.173.0.21-1.git.0.f95b0e7.el7 |
| Red Hat openshift 3.6 | atomic-openshift-pod | 0:3.6.173.0.21-1.git.0.f95b0e7.el7 |
| Red Hat openshift 3.6 | atomic-openshift-sdn-ovs | 0:3.6.173.0.21-1.git.0.f95b0e7.el7 |
| Red Hat openshift 3.6 | atomic-openshift-service-catalog | 0:3.6.173.0.21-1.git.0.f95b0e7.el7 |
| Red Hat openshift 3.6 | atomic-openshift-tests | 0:3.6.173.0.21-1.git.0.f95b0e7.el7 |
| Red Hat openshift 3.6 | fluentd | 0:0.12.39-2.el7 |
| Red Hat openshift 3.6 | fluentd-doc | 0:0.12.39-2.el7 |
| Red Hat openshift 3.6 | jenkins-2-plugins | 0:3.7.1502412812-1.el7 |
| Red Hat openshift 3.6 | kibana | 0:4.6.4-3.el7 |
| Red Hat openshift 3.6 | kibana-debuginfo | 0:4.6.4-3.el7 |
| Red Hat openshift 3.6 | rubygem-cool.io | 0:1.5.1-1.el7 |
| Red Hat openshift 3.6 | rubygem-cool.io-debuginfo | 0:1.5.1-1.el7 |
| Red Hat openshift 3.6 | rubygem-cool.io-doc | 0:1.5.1-1.el7 |
| Red Hat openshift 3.6 | rubygem-excon | 0:0.58.0-1.el7 |
| Red Hat openshift 3.6 | rubygem-excon-doc | 0:0.58.0-1.el7 |
| Red Hat openshift 3.6 | rubygem-faraday | 0:0.13.0-1.el7 |
| Red Hat openshift 3.6 | rubygem-faraday-doc | 0:0.13.0-1.el7 |
| Red Hat openshift 3.6 | rubygem-fluent-plugin-kubernetes_metadata_filter | 0:0.29.0-1.el7 |
| Red Hat openshift 3.6 | rubygem-fluent-plugin-kubernetes_metadata_filter-doc | 0:0.29.0-1.el7 |
| Red Hat openshift 3.6 | rubygem-fluent-plugin-viaq_data_model | 0:0.0.5-1.el7 |
| Red Hat openshift 3.6 | rubygem-fluent-plugin-viaq_data_model-doc | 0:0.0.5-1.el7 |
| Red Hat openshift 3.6 | rubygem-i18n | 0:0.8.6-1.el7 |
| Red Hat openshift 3.6 | rubygem-i18n-doc | 0:0.8.6-1.el7 |
| Red Hat openshift 3.6 | rubygem-systemd-journal | 0:1.3.0-1.el7 |
| Red Hat openshift 3.6 | rubygem-systemd-journal-doc | 0:1.3.0-1.el7 |
| Red Hat openshift 3.6 | tuned-profiles-atomic-openshift-node | 0:3.6.173.0.21-1.git.0.f95b0e7.el7 |