Bug 1819182 (CVE-2020-2115)

Summary:	CVE-2020-2115 jenkins-nUnit-plugin: XML parser not configured to prevent XEE
Product:	[Other] Security Response	Reporter:	Dhananjay Arunesh <darunesh>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	claudiorodrigo, mailinglists
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-28 05:24:55 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Dhananjay Arunesh 2020-03-31 12:16:54 UTC

A vulnerability was found in Jenkins NUnit Plugin 0.25 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks.

Reference:
http://www.openwall.com/lists/oss-security/2020/02/12/3

Comment 1 Dhananjay Arunesh 2020-03-31 12:17:36 UTC

External References:

https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1752

Comment 2 Timotheus Pokorra 2020-04-01 04:14:23 UTC

I don't think, this affects the package https://apps.fedoraproject.org/packages/nunit or https://apps.fedoraproject.org/packages/nunit2
If I understand correctly, this security issue is in a plugin of Jenkins, which includes NUnit in Jenkins.
I have never heard about NUnit Plugin 0.25 before.

https://plugins.jenkins.io/nunit/
"This plugin makes it possible to import NUnit reports from each build into Jenkins so they are displayed with a trend graph and details about which tests that failed."