CVE-2019-16555: Medium severity jenkins build failure analyzer plugin vulnerability
A user-supplied regular expression in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier was processed in a way that wasn't interruptible, allowing attackers to have Jenkins evaluate a regular expression without the ability to interrupt this process.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-16555?
CVE-2019-16555 is a vulnerability in the Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier that allows attackers to evaluate a user-supplied regular expression without interrupting the process.
How severe is CVE-2019-16555?
CVE-2019-16555 has a severity rating of 6.5, which is considered medium.
What software is affected by CVE-2019-16555?
Jenkins Build Failure Analyzer Plugin versions up to 1.24.1 and the package 'com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer' with versions up to 1.24.2 are affected by CVE-2019-16555.
How can I fix CVE-2019-16555?
To fix CVE-2019-16555, you should update Jenkins Build Failure Analyzer Plugin to version 1.24.2 or later.
Is there any additional information about CVE-2019-16555?
You can find additional information about CVE-2019-16555 on the Openwall and Jenkins websites, as well as the NIST Vulnerability Database.