The Plugins Manager in Jenkins before 1.640 and LTS before 1.625.2 does not verify checksums for plugin files referenced in update site data, which makes it easier for man-in-the-middle attackers to execute arbitrary code via a crafted plugin.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Jenkins 2015 12 09 | — | Upgrade Jenkins LTS to version 1.625.3Upgrade Jenkins to the latest versionUpgrade Jenkins LTS to the latest versionUpgrade Jenkins to version 1.641 | Nov 13, 2017 | Feb 3, 2016 |
| Redhat Openshift | — | Upgrade nodejs-deep-extendUpgrade rhcUpgrade nodejs-kind-ofUpgrade nodejs-is-dotfileUpgrade nodejs-is-equal-shallowUpgrade nodejs-lodash.isarrayUpgrade phpUpgrade nodejs-ansi-wrapUpgrade openshift-ansibleUpgrade openshift-origin-cartridge-mysqlUpgrade nodejs-iniUpgrade nodejs-lodash.basecopyUpgrade nodejs-rcUpgrade heapsterUpgrade nodejs-write-file-atomicUpgrade nodejs-configstoreUpgrade nodejs-readdirpUpgrade nodejs-lodash.createassignerUpgrade nodejs-regex-cacheUpgrade nodejs-duplexifyUpgrade nodejs-uuidUpgrade nodejs-touchUpgrade nodejs-lodash.defaultsUpgrade nodejs-gotUpgrade nodejs-url-parse-laxUpgrade nodejs-arr-diffUpgrade nodejs-async-eachUpgrade nodejs-lodash.getnativeUpgrade rubygem-openshift-origin-nodeUpgrade origin-kibanaUpgrade nodejs-end-of-streamUpgrade nodejs-pause-streamUpgrade nodejs-is-primitiveUpgrade nodejs-filename-regexUpgrade nodejs-pinkieUpgrade openshift-origin-broker-utilUpgrade nodejs-preserveUpgrade nodejs-undefsafeUpgrade nodejs-anymatchUpgrade nodejs-map-streamUpgrade nodejs-glob-baseUpgrade nodejs-lazy-cacheUpgrade nodejs-expand-rangeUpgrade nodejs-arrifyUpgrade nodejs-graceful-fsUpgrade nodejs-is-streamUpgrade nodejs-is-redirectUpgrade nodejs-is-extendableUpgrade openshift-enterprise-upgradeUpgrade nodejs-normalize-pathUpgrade nodejs-object-assignUpgrade nodejs-package-jsonUpgrade openshift-origin-cartridge-pythonUpgrade nodejs-semverUpgrade nodejs-object.omitUpgrade nodejs-update-notifierUpgrade openshift-origin-cartridge-cronUpgrade nodejs-create-error-classUpgrade nodejs-extglobUpgrade nss_wrapperUpgrade nodejs-micromatchUpgrade nodejs-repeat-elementUpgrade jenkinsUpgrade nodejs-glob-parentUpgrade openshift-origin-cartridge-haproxyUpgrade openshift-origin-msg-node-mcollectiveUpgrade nodejs-pinkie-promiseUpgrade nodejs-lodash.isiterateecallUpgrade openvswitchUpgrade nodejs-mkdirpUpgrade nodejs-read-all-streamUpgrade nodejs-strip-json-commentsUpgrade nodejs-bracesUpgrade nodejs-is-numberUpgrade rubygem-openshift-origin-frontend-apache-vhostUpgrade nodejs-latest-versionUpgrade nodejs-arr-flattenUpgrade nodejs-lodash.assignUpgrade openshift-origin-node-utilUpgrade nodejs-node-status-codesUpgrade nodejs-ps-treeUpgrade nodejs-lodash.bindcallbackUpgrade nodejs-parse-globUpgrade nodejs-duplexerUpgrade nodejs-parse-jsonUpgrade nodejs-lodash.restparamUpgrade rubygem-openshift-origin-commonUpgrade nodejs-semver-diffUpgrade nodejs-string-lengthUpgrade nodejs-randomaticUpgrade nodejs-is-extglobUpgrade nodejs-success-symbolUpgrade nodejs-lodash.isargumentsUpgrade nodejs-osenvUpgrade activemqUpgrade nodejs-prepend-httpUpgrade nodejs-nodemonUpgrade nodejs-es6-promiseUpgrade nodejs-for-inUpgrade rubygem-openshift-origin-controllerUpgrade nodejs-timed-outUpgrade nodejs-array-uniqueUpgrade nodejs-os-tmpdirUpgrade atomic-openshiftUpgrade nodejs-isobjectUpgrade nodejs-align-textUpgrade nodejs-is-npmUpgrade nodejs-is-globUpgrade nodejs-expand-bracketsUpgrade nodejs-os-homedirUpgrade nodejs-is-binary-pathUpgrade openshift-origin-node-proxyUpgrade nodejs-fill-rangeUpgrade rubygem-openshift-origin-consoleUpgrade nodejs-lowercase-keysUpgrade nodejs-is-plain-objUpgrade nodejs-error-exUpgrade nodejs-registry-urlUpgrade nodejs-throughUpgrade nodejs-for-ownUpgrade nodejs-xdg-basedirUpgrade nodejs-chokidarUpgrade nodejs-stream-combinerUpgrade nodejs-lodash.baseassignUpgrade nodejs-binary-extensionsUpgrade nodejs-slideUpgrade nodejs-fromUpgrade openshift-origin-cartridge-phpUpgrade nodejs-event-streamUpgrade nodejs-lodash.keysUpgrade nodejs-capture-stack-traceUpgrade nodejs-unzip-responseUpgrade nodejs-ansi-greenUpgrade nodejs-splitUpgrade nodejs-optimist | Jun 18, 2018 | Dec 9, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub