GHSA-mcqx-wc2j-qx9v

GitHub Authentication Plugin session fixation vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-1003019

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:github-oauth	< 0.31	0.31

Details

As written in the advisory (Markdown source, shown as plain text).

An session fixation vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm.java that allows unauthorized attackers to impersonate another user if they can control the pre-authentication session.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-1003019 advisory
https://github.com/jenkinsci/github-oauth-plugin/commit/3fcc367022c58486e5f52def3edbac92ed258ba4 web
https://github.com/jenkinsci/github-oauth-plugin package
https://jenkins.io/security/advisory/2019-01-28/#SECURITY-797 web