GHSA-2w2m-ccf8-57cq

XXE vulnerability in Jenkins REPO Plugin

Source: GitHub Advisory Database (reviewed) High CVE-2022-43415

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:repo	< 1.16.0	1.16.0

Details

As written in the advisory (Markdown source, shown as plain text).

REPO Plugin 1.15.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. This allows attackers able to control which `repo` binary is executed on agents to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery. REPO Plugin 1.16.0 disables external entity resolution for its XML parser.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-43415 advisory
https://github.com/jenkinsci/repo-plugin/commit/4c4a72c7de3d3e5bbbad223605ea264dcec56bc1 web
https://github.com/jenkinsci/repo-plugin package
https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2337 web
http://www.openwall.com/lists/oss-security/2022/10/19/3 web