4.3

CVE-2012-6072

CRLF injection vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cloudbees ≫ Jenkins Version 1.447.1.1 Update - Edition enterprise
Cloudbees ≫ Jenkins Version 1.447.2.2 Update - Edition enterprise
Cloudbees ≫ Jenkins Version 1.447.3.1 Update - Edition enterprise
Cloudbees ≫ Jenkins Version 1.400 Update - Edition lts
Cloudbees ≫ Jenkins Version 1.424 Update - Edition lts
Cloudbees ≫ Jenkins Version 1.447 Update - Edition lts
Jenkins ≫ Jenkins Version <= 1.466.2
Jenkins ≫ Jenkins Version 1.409.1
Jenkins ≫ Jenkins Version 1.409.2
Jenkins ≫ Jenkins Version 1.409.3
Jenkins ≫ Jenkins Version 1.424.1
Jenkins ≫ Jenkins Version 1.424.2
Jenkins ≫ Jenkins Version 1.424.3
Jenkins ≫ Jenkins Version 1.424.4
Jenkins ≫ Jenkins Version 1.424.5
Jenkins ≫ Jenkins Version 1.424.6
Jenkins ≫ Jenkins Version 1.447.1
Jenkins ≫ Jenkins Version 1.447.2
Jenkins ≫ Jenkins Version 1.466.1
Cloudbees ≫ Jenkins Version 1.466.1.2 Update - Edition enterprise
Cloudbees ≫ Jenkins Version 1.466.2.1 Update - Edition enterprise
Cloudbees ≫ Jenkins Version <= 1.480.3.1
Jenkins ≫ Jenkins Version 1.400
Jenkins ≫ Jenkins Version 1.401
Jenkins ≫ Jenkins Version 1.402
Jenkins ≫ Jenkins Version 1.403
Jenkins ≫ Jenkins Version 1.404
Jenkins ≫ Jenkins Version 1.405
Jenkins ≫ Jenkins Version 1.406
Jenkins ≫ Jenkins Version 1.407
Jenkins ≫ Jenkins Version 1.408
Jenkins ≫ Jenkins Version 1.409
Jenkins ≫ Jenkins Version 1.410
Jenkins ≫ Jenkins Version 1.411
Jenkins ≫ Jenkins Version 1.412
Jenkins ≫ Jenkins Version 1.413
Jenkins ≫ Jenkins Version 1.414
Jenkins ≫ Jenkins Version 1.415
Jenkins ≫ Jenkins Version 1.416
Jenkins ≫ Jenkins Version 1.417
Jenkins ≫ Jenkins Version 1.418
Jenkins ≫ Jenkins Version 1.419
Jenkins ≫ Jenkins Version 1.420
Jenkins ≫ Jenkins Version 1.421
Jenkins ≫ Jenkins Version 1.422
Jenkins ≫ Jenkins Version 1.423
Jenkins ≫ Jenkins Version 1.424
Jenkins ≫ Jenkins Version 1.425
Jenkins ≫ Jenkins Version 1.426
Jenkins ≫ Jenkins Version 1.427
Jenkins ≫ Jenkins Version 1.428
Jenkins ≫ Jenkins Version 1.429
Jenkins ≫ Jenkins Version 1.430
Jenkins ≫ Jenkins Version 1.431
Jenkins ≫ Jenkins Version 1.432
Jenkins ≫ Jenkins Version 1.433
Jenkins ≫ Jenkins Version 1.434
Jenkins ≫ Jenkins Version 1.435
Jenkins ≫ Jenkins Version 1.436
Jenkins ≫ Jenkins Version 1.437
Cloudbees ≫ Jenkins Version 1.424.0.2 Update - Edition enterprise
Cloudbees ≫ Jenkins Version 1.424.0.4 Update - Edition enterprise
Cloudbees ≫ Jenkins Version 1.424.1.1 Update - Edition enterprise
Cloudbees ≫ Jenkins Version 1.424.2.1 Update - Edition enterprise
Cloudbees ≫ Jenkins Version 1.424.4.1 Update - Edition enterprise
Cloudbees ≫ Jenkins Version 1.424.5.1 Update - Edition enterprise
Cloudbees ≫ Jenkins Version 1.424.6.1 Update - Edition enterprise
Cloudbees ≫ Jenkins Version 1.424.6.11 Update - Edition enterprise
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.83% 0.762
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://rhn.redhat.com/errata/RHSA-2013-0220.html
http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2012-11-20.cb
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=890607
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2012-11-20
Vendor Advisory