Bug 1819067 (CVE-2020-2139) - CVE-2020-2139 jenkins-cobertura-plugin: arbitrary file write vulnerability
Summary: CVE-2020-2139 jenkins-cobertura-plugin: arbitrary file write vulnerability
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2020-2139
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1819068
TreeView+ depends on / blocked
 
Reported: 2020-03-31 06:56 UTC by Dhananjay Arunesh
Modified: 2021-02-16 20:22 UTC (History)
10 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2020-04-02 07:55:31 UTC
Embargoed:

Attachments (Terms of Use)

Description Dhananjay Arunesh 2020-03-31 06:56:59 UTC 
An arbitrary file write vulnerability in Jenkins Cobertura Plugin 1.15 and earlier allows attackers able to control the coverage report file contents to overwrite any file on the Jenkins master file system.

Reference:
http://www.openwall.com/lists/oss-security/2020/03/09/1
Comment 1 Dhananjay Arunesh 2020-03-31 06:57:54 UTC 
External References:

https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1668
Note You need to log in before you can comment on or make changes to this bug.