GHSA-543w-gq76-pw7g

Cross-Site Request Forgery in Jenkins Build Failure Analyzer Plugin

Source: GitHub Advisory Database (reviewed) High CVE-2019-16553

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer	< 1.24.2	1.24.2

Details

As written in the advisory (Markdown source, shown as plain text).

A cross-site request forgery vulnerability in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers to have Jenkins evaluate a computationally expensive regular expression.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-16553 advisory
https://github.com/jenkinsci/build-failure-analyzer-plugin/commit/f316c885552ac75289cbb11b2af5757f18784bcb web
https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1651 web
http://www.openwall.com/lists/oss-security/2019/12/17/1 web