GitHub Advisoryadvisory · Maven

GHSA-8qpf-fv36-h4r8 Infinite Loop in Jenkins Core

MEDIUM Published 2022-05-13 Modified 2022-11-02 Official page ↗
Aliases
CVE-2018-1999044
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-835
Reviewed
2022-11-02

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: < 2.138 → fixed in 2.138

Description

A Cron expression form validation could enter infinite loop, potentially resulting in denial of service. The form validation for cron expressions (e.g. "Poll SCM", "Build periodically") could enter infinite loops when cron expressions only matching certain rare dates were entered, blocking request handling threads indefinitely.

Related

Alias · CVE (1)

  • CVE-2018-1999044 A denial of service vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in CronTab.java that allows attackers with… vulnerability

Weakness · CWE (1)

  • CWE-835 Loop with Unreachable Exit Condition weakness

References