Bug 1819182 (CVE-2020-2115) - CVE-2020-2115 jenkins-nUnit-plugin: XML parser not configured to prevent XEE
Summary: CVE-2020-2115 jenkins-nUnit-plugin: XML parser not configured to prevent XEE
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2020-2115
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-03-31 12:16 UTC by Dhananjay Arunesh
Modified: 2021-10-28 05:24 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2021-10-28 05:24:55 UTC
Embargoed:

Attachments (Terms of Use)

Description Dhananjay Arunesh 2020-03-31 12:16:54 UTC 
A vulnerability was found in Jenkins NUnit Plugin 0.25 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks.

Reference:
http://www.openwall.com/lists/oss-security/2020/02/12/3
Comment 1 Dhananjay Arunesh 2020-03-31 12:17:36 UTC 
External References:

https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1752
Comment 2 Timotheus Pokorra 2020-04-01 04:14:23 UTC 
I don't think, this affects the package https://apps.fedoraproject.org/packages/nunit or https://apps.fedoraproject.org/packages/nunit2
If I understand correctly, this security issue is in a plugin of Jenkins, which includes NUnit in Jenkins.
I have never heard about NUnit Plugin 0.25 before.

https://plugins.jenkins.io/nunit/
"This plugin makes it possible to import NUnit reports from each build into Jenkins so they are displayed with a trend graph and details about which tests that failed."
Note You need to log in before you can comment on or make changes to this bug.