Regular Expression Processing Vulnerability in Jenkins Build Failure Analyzer Plugin
CVE-2019-16555

6.5MEDIUM

Key Information:

Vendor

Jenkins
Status
Jenkins Build Failure Analyzer Plugin
Vendor
CVE Published:
17 December 2019

What is CVE-2019-16555?

A vulnerability exists in the Jenkins Build Failure Analyzer Plugin where user-supplied regular expressions can be processed in an uninterruptible manner. This can allow attackers to exploit the inability to interrupt the evaluation of the regular expression, which may lead to performance issues and potential Denial of Service conditions. The affected versions include Build Failure Analyzer Plugin 1.24.1 and earlier, necessitating immediate attention and remediation by users to mitigate risks.

Affected Version(s)

Jenkins Build Failure Analyzer Plugin <= 1.24.1

References

https://jenkins.io/security/advisory/2019-12-17/#SECURITY...
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2019/12/17/1
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2019-16555 : Regular Expression Processing Vulnerability in Jenkins Build Failure Analyzer Plugin