CVE-2019-16555 - A user-supplied regular expression in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier was processed in a way that wasn't interruptible, allowing attackers to have Jenkins evaluate a regular expression without the ability to interrupt this process

Back Back to CVE browser

MEDIUM

A user-supplied regular expression in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier was processed in a way that wasn't interruptible, allowing attackers to have Jenkins evaluate a regular expression without the ability to interrupt this process

Published Dec 17, 2019

6.5

MEDIUM

CVSS 3.1

EPSS 1.08%

Description

A user-supplied regular expression in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier was processed in a way that wasn't interruptible, allowing attackers to have Jenkins evaluate a regular expression without the ability to interrupt this process.

Affected products

Vendor Jenkins project Product Jenkins Build Failure Analyzer Plugin Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <=1.24.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Jenkins project

Jenkins Build Failure Analyzer Plugin

n/a

Version	Status	Constraints
unspecified	affected	<=1.24.1

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-1333

CWE-400

Uncontrolled Resource Consumption

References (6)

http://www.openwall.com/lists/oss-security/2019/12/17/1
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-1992
Advisory
https://github.com/advisories/GHSA-2hhc-f86x-x74f
Advisory
https://github.com/jenkinsci/build-failure-analyzer-plugin/commit/f316c885552ac75289cbb11b2af5757f18784bcb
https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1651
x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-16555

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2019/12/17/1		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-1992		Advisory
https://github.com/advisories/GHSA-2hhc-f86x-x74f		Advisory
https://github.com/jenkinsci/build-failure-analyzer-plugin/commit/f316c885552ac75289cbb11b2af5757f18784bcb
https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1651		x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-16555