CVE-2019-10357: Medium severity jenkins pipeline vulnerability
A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited information about the content of SCM repositories referenced by global libraries.
Other sources
The Jenkins Pipeline: Shared Groovy Libraries Plugin provides form validation to determine whether the revision (e.g. commit, tag, or branch name) specified for a global library exists in the repository. This form validation method lacked a permission check, allowing attackers with Overall/Read access to determine whether an attacker-specified revision exists in an SCM repository configured for use in an existing shared library.
Pipeline: Shared Groovy Libraries Plugin now performs the appropriate permission check.
External References:
https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1422
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-10357?
CVE-2019-10357 has a medium severity rating due to a missing permission check that could allow unauthorized access to SCM repository information.
How do I fix CVE-2019-10357?
To fix CVE-2019-10357, upgrade the Jenkins Pipeline: Shared Groovy Libraries Plugin to version 2.15 or later.
What systems are affected by CVE-2019-10357?
CVE-2019-10357 affects Jenkins Pipeline: Shared Groovy Libraries Plugin version 2.14 and earlier, as well as certain versions of Red Hat OpenShift Container Platform.
What type of vulnerability is CVE-2019-10357?
CVE-2019-10357 is a permissions-related vulnerability that allows users to access limited information in SCM repositories.
Can I mitigate CVE-2019-10357 without upgrading?
Mitigation options are limited; the recommended action is to upgrade the affected plugin to avoid risk.