VDB
Sign up
MEDIUM4.3

GHSA-463r-5m89-4xfr

Jenkins Open Redirect Through Newline/Tab Characters in Redirect URL

Quick fix

GHSA-463r-5m89-4xfr — org.jenkins-ci.main:jenkins-core: upgrade to the fixed version with the command below.

# pom.xml: bump <version>2.555.3</version> for org.jenkins-ci.main:jenkins-core

Details

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between `//`, allowing attackers to perform phishing attacks.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven/org.jenkins-ci.main:jenkins-core
Introduced in: 0Fixed in: 2.555.3
Fix# pom.xml: bump <version>2.555.3</version> for org.jenkins-ci.main:jenkins-core
Maven/org.jenkins-ci.main:jenkins-core
Introduced in: 2.556Fixed in: 2.568
Fix# pom.xml: bump <version>2.568</version> for org.jenkins-ci.main:jenkins-core

References