jenkins: External entity processing in XML can reveal sensitive local files (SECURITY-167)
Published Jan 15, 2020
7.5
HIGHCVSS 3.1
EPSS 1.41%
Description
XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via a crafted XML document.
Affected products
-
Affected
- before 1.600
-
Affected
- before 1.596.1
Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| CloudBees | Jenkins | unknown | Affected
|
| CloudBees | Jenkins LTS | unknown | Affected
|
No data.
Red Hat OpenShift Enterprise 2.2
jenkins-0:1.609.1-1.el6op
Fixed · RHSA-2015:1844
Red Hat OpenShift Enterprise 2.2
openshift-origin-broker-0:1.16.2.10-1.el6op
Fixed · RHSA-2015:1844
Red Hat OpenShift Enterprise 2.2
openshift-origin-broker-util-0:1.36.2.2-1.el6op
Fixed · RHSA-2015:1844
Red Hat OpenShift Enterprise 2.2
openshift-origin-cartridge-diy-0:1.26.1.1-1.el6op
Fixed · RHSA-2015:1844
Red Hat OpenShift Enterprise 2.2
openshift-origin-cartridge-haproxy-0:1.30.1.1-1.el6op
Fixed · RHSA-2015:1844
Red Hat OpenShift Enterprise 2.2
openshift-origin-cartridge-jbosseap-0:2.26.3.1-1.el6op
Fixed · RHSA-2015:1844
Red Hat OpenShift Enterprise 2.2
openshift-origin-cartridge-jbossews-0:1.34.3.1-1.el6op
Fixed · RHSA-2015:1844
Red Hat OpenShift Enterprise 2.2
openshift-origin-cartridge-jenkins-0:1.28.2.1-1.el6op
Fixed · RHSA-2015:1844
Red Hat OpenShift Enterprise 2.2
openshift-origin-cartridge-mock-0:1.22.1.1-1.el6op
Fixed · RHSA-2015:1844
Red Hat OpenShift Enterprise 2.2
openshift-origin-cartridge-nodejs-0:1.33.1.1-1.el6op
Fixed · RHSA-2015:1844
Red Hat OpenShift Enterprise 2.2
openshift-origin-cartridge-perl-0:1.30.1.1-1.el6op
Fixed · RHSA-2015:1844
Red Hat OpenShift Enterprise 2.2
openshift-origin-cartridge-php-0:1.34.1.1-1.el6op
Fixed · RHSA-2015:1844
Red Hat OpenShift Enterprise 2.2
openshift-origin-cartridge-python-0:1.33.3.1-1.el6op
Fixed · RHSA-2015:1844
Red Hat OpenShift Enterprise 2.2
openshift-origin-cartridge-ruby-0:1.32.1.1-1.el6op
Fixed · RHSA-2015:1844
Red Hat OpenShift Enterprise 2.2
openshift-origin-logshifter-0:1.10.1.2-1.el6op
Fixed · RHSA-2015:1844
Red Hat OpenShift Enterprise 2.2
openshift-origin-node-util-0:1.37.2.1-1.el6op
Fixed · RHSA-2015:1844
Red Hat OpenShift Enterprise 2.2
rhc-0:1.37.1.2-1.el6op
Fixed · RHSA-2015:1844
Red Hat OpenShift Enterprise 2.2
rubygem-openshift-origin-console-0:1.35.2.1-1.el6op
Fixed · RHSA-2015:1844
Red Hat OpenShift Enterprise 2.2
rubygem-openshift-origin-controller-0:1.37.3.1-1.el6op
Fixed · RHSA-2015:1844
Red Hat OpenShift Enterprise 2.2
rubygem-openshift-origin-frontend-apache-vhost-0:0.12.4.2-1.el6op
Fixed · RHSA-2015:1844
Red Hat OpenShift Enterprise 2.2
rubygem-openshift-origin-gear-placement-0:0.0.2.1-1.el6op
Fixed · RHSA-2015:1844
Red Hat OpenShift Enterprise 2.2
rubygem-openshift-origin-msg-broker-mcollective-0:1.35.3.1-1.el6op
Fixed · RHSA-2015:1844
Red Hat OpenShift Enterprise 2.2
rubygem-openshift-origin-node-0:1.37.1.1-1.el6op
Fixed · RHSA-2015:1844
Red Hat OpenShift Enterprise 2.2
rubygem-openshift-origin-routing-daemon-0:0.25.1.2-1.el6op
Fixed · RHSA-2015:1844
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat OpenShift Enterprise 2.2 | jenkins-0:1.609.1-1.el6op | Fixed | RHSA-2015:1844 |
| Red Hat OpenShift Enterprise 2.2 | openshift-origin-broker-0:1.16.2.10-1.el6op | Fixed | RHSA-2015:1844 |
| Red Hat OpenShift Enterprise 2.2 | openshift-origin-broker-util-0:1.36.2.2-1.el6op | Fixed | RHSA-2015:1844 |
| Red Hat OpenShift Enterprise 2.2 | openshift-origin-cartridge-diy-0:1.26.1.1-1.el6op | Fixed | RHSA-2015:1844 |
| Red Hat OpenShift Enterprise 2.2 | openshift-origin-cartridge-haproxy-0:1.30.1.1-1.el6op | Fixed | RHSA-2015:1844 |
| Red Hat OpenShift Enterprise 2.2 | openshift-origin-cartridge-jbosseap-0:2.26.3.1-1.el6op | Fixed | RHSA-2015:1844 |
| Red Hat OpenShift Enterprise 2.2 | openshift-origin-cartridge-jbossews-0:1.34.3.1-1.el6op | Fixed | RHSA-2015:1844 |
| Red Hat OpenShift Enterprise 2.2 | openshift-origin-cartridge-jenkins-0:1.28.2.1-1.el6op | Fixed | RHSA-2015:1844 |
| Red Hat OpenShift Enterprise 2.2 | openshift-origin-cartridge-mock-0:1.22.1.1-1.el6op | Fixed | RHSA-2015:1844 |
| Red Hat OpenShift Enterprise 2.2 | openshift-origin-cartridge-nodejs-0:1.33.1.1-1.el6op | Fixed | RHSA-2015:1844 |
| Red Hat OpenShift Enterprise 2.2 | openshift-origin-cartridge-perl-0:1.30.1.1-1.el6op | Fixed | RHSA-2015:1844 |
| Red Hat OpenShift Enterprise 2.2 | openshift-origin-cartridge-php-0:1.34.1.1-1.el6op | Fixed | RHSA-2015:1844 |
| Red Hat OpenShift Enterprise 2.2 | openshift-origin-cartridge-python-0:1.33.3.1-1.el6op | Fixed | RHSA-2015:1844 |
| Red Hat OpenShift Enterprise 2.2 | openshift-origin-cartridge-ruby-0:1.32.1.1-1.el6op | Fixed | RHSA-2015:1844 |
| Red Hat OpenShift Enterprise 2.2 | openshift-origin-logshifter-0:1.10.1.2-1.el6op | Fixed | RHSA-2015:1844 |
| Red Hat OpenShift Enterprise 2.2 | openshift-origin-node-util-0:1.37.2.1-1.el6op | Fixed | RHSA-2015:1844 |
| Red Hat OpenShift Enterprise 2.2 | rhc-0:1.37.1.2-1.el6op | Fixed | RHSA-2015:1844 |
| Red Hat OpenShift Enterprise 2.2 | rubygem-openshift-origin-console-0:1.35.2.1-1.el6op | Fixed | RHSA-2015:1844 |
| Red Hat OpenShift Enterprise 2.2 | rubygem-openshift-origin-controller-0:1.37.3.1-1.el6op | Fixed | RHSA-2015:1844 |
| Red Hat OpenShift Enterprise 2.2 | rubygem-openshift-origin-frontend-apache-vhost-0:0.12.4.2-1.el6op | Fixed | RHSA-2015:1844 |
| Red Hat OpenShift Enterprise 2.2 | rubygem-openshift-origin-gear-placement-0:0.0.2.1-1.el6op | Fixed | RHSA-2015:1844 |
| Red Hat OpenShift Enterprise 2.2 | rubygem-openshift-origin-msg-broker-mcollective-0:1.35.3.1-1.el6op | Fixed | RHSA-2015:1844 |
| Red Hat OpenShift Enterprise 2.2 | rubygem-openshift-origin-node-0:1.37.1.1-1.el6op | Fixed | RHSA-2015:1844 |
| Red Hat OpenShift Enterprise 2.2 | rubygem-openshift-origin-routing-daemon-0:0.25.1.2-1.el6op | Fixed | RHSA-2015:1844 |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (8)
- https://access.redhat.com/security/cve/CVE-2015-1811 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1205632 x_refsource_MISCIssue TrackingThird Party Advisory
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-4967 Advisory
- https://github.com/advisories/GHSA-qg7x-4h4q-3m49 Advisory
- https://jenkins.io/security/advisory/2015-02-27/ x_refsource_CONFIRMVendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2015-1811
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27
- https://www.cve.org/CVERecord?id=CVE-2015-1811
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2015-1811 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1205632 | x_refsource_MISCIssue TrackingThird Party Advisory | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-4967 | Advisory | |
| https://github.com/advisories/GHSA-qg7x-4h4q-3m49 | Advisory | |
| https://jenkins.io/security/advisory/2015-02-27/ | x_refsource_CONFIRMVendor Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2015-1811 | ||
| https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27 | ||
| https://www.cve.org/CVERecord?id=CVE-2015-1811 |
Change history (0)
No recorded changes yet.
CVE.org / MITRE
CISA Vulnrichment
No data
GitHub