high8.8
CVE-2019-10392
Improper Neutralization of Special Elements used in an OS Command in Jenkins Git Client Plugin
Impact
Jenkins Git Client Plugin 2.8.4 and earlier did not properly restrict values passed as URL argument to an invocation of 'git ls-remote', resulting in OS command injection.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:git-client | <= 2.8.4 | 2.8.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Git Client | through 2.8.4 Version 3.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.openwall.com/lists/oss-security/2019/09/12/2
- https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1534
- https://github.com/advisories/GHSA-hw6x-2qwv-rxr7
- https://nvd.nist.gov/vuln/detail/CVE-2019-10392
- https://github.com/jenkinsci/git-client-plugin/commit/899123fa2eb9dd2c37137aae630c47c6be6b4b02