medium4.3
CVE-2016-3721
Jenkins before 2.3 and LTS before 1.651.2 might allow remote authenticated users to inject arbitrary build parameters into the build environment via environmen…
Impact
Jenkins before 2.3 and LTS before 1.651.2 might allow remote authenticated users to inject arbitrary build parameters into the build environment via environment variables.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Openshift | Versions 3.1, 3.2 |
| Jenkins | Jenkins | through 1.651.1 through 2.2 |
Weakness classification
References
- NVD record
- CVE.org record
- http://rhn.redhat.com/errata/RHSA-2016-1773.html
- http://www.openwall.com/lists/oss-security/2024/05/02/3
- https://access.redhat.com/errata/RHSA-2016:1206
- https://wiki.jenkins-ci.org/display/JENKINS/Plugins+affected+by+fix+for+SECURITY-170
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11
- https://www.cloudbees.com/jenkins-security-advisory-2016-05-11
- http://rhn.redhat.com/errata/RHSA-2016-1773.html
- http://www.openwall.com/lists/oss-security/2024/05/02/3
- https://access.redhat.com/errata/RHSA-2016:1206
- https://wiki.jenkins-ci.org/display/JENKINS/Plugins+affected+by+fix+for+SECURITY-170
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11
- https://www.cloudbees.com/jenkins-security-advisory-2016-05-11