CVE-2018-1999044: Medium severity Jenkins Jenkins vulnerability
A Cron expression form validation could enter infinite loop, potentially resulting in denial of service. The form validation for cron expressions (e.g. "Poll SCM", "Build periodically") could enter infinite loops when cron expressions only matching certain rare dates were entered, blocking request handling threads indefinitely.
Other sources
A denial of service vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in CronTab.java that allows attackers with Overall/Read permission to have a request handling thread enter an infinite loop.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1999044?
CVE-2018-1999044 is considered a denial of service vulnerability due to the potential for infinite loops during form validation.
How do I fix CVE-2018-1999044?
To fix CVE-2018-1999044, update Jenkins to version 2.138 or later.
Which versions of Jenkins are affected by CVE-2018-1999044?
Jenkins versions up to and including 2.121.2 and 2.137 are affected by CVE-2018-1999044.
What is the impact of CVE-2018-1999044?
The impact of CVE-2018-1999044 includes potential denial of service due to an infinite loop in the cron expression form validation.
Is CVE-2018-1999044 related to cron expression validation?
Yes, CVE-2018-1999044 specifically affects the validation of cron expressions in Jenkins.