GHSA-4rj6-9pjh-882r

Improper Restriction of XML External Entity Reference in Jenkins JUnit Plugin

Source: GitHub Advisory Database (reviewed) High CVE-2018-1000056

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:junit	< 1.24	1.24

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins JUnit Plugin 1.23 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-1000056 advisory
https://github.com/jenkinsci/junit-plugin/commit/15f39fc49d9f25bca872badb48e708a8bb815ea7 web
https://github.com/jenkinsci/junit-plugin package
https://jenkins.io/security/advisory/2018-02-05 web