CVE-2019-10392: jenkins project jenkins git client plugin OS Command Injection

CVSS: 8.8v3.1HighModified

AliasesRHBA-2020:0522RHBA-2020:0690GHSA-hw6x-2qwv-rxr7

Published 12-09-2019Last modified 04-08-2024

Vulnerability summary

CVE-2019-10392 is a high (CVSS 8.8) OS Command Injection vulnerability in jenkins project jenkins git client plugin. EPSS estimates a 26.23% chance of exploitation in the next 30 days, higher than 97.9% of scored vulnerabilities.

Overall risk

40/100

0100

Medium · default modelHow is this calculated?

CVSS score

8.8/10

010

High · v3.1 (NVD)

EPSS score

26.23%

0%100%

High · +0.45 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2

RHBA-2020:0527 RHSA-2020:2478

Timeline

12-09-2019
PublishedVulnerability first disclosed.
04-08-2024
Last modifiedVulnerability information updated.

Description

Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of 'git ls-remote', resulting in OS command injection.

CVSS metrics

4 scores · 3 sources · 2 versions

v3.18.8v2.06.5

EPSS trend

Probability

26.23%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

+0.45 pp

From 25.78% on 19-09-2026

19-09-202619-10-2026

EPSS score

26.23%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Affected systems

Redhat30 products

atomic-enterprise-service-catalog< 1:4.2.20-202002170402.git.1.159e2f5.el7 | < 1:4.1.37-202003020601.git.0.5784dc4.el7
atomic-enterprise-service-catalog-svcat< 1:4.2.20-202002170402.git.1.159e2f5.el7 | < 1:4.1.37-202003020601.git.0.5784dc4.el7
atomic-openshift-service-idler< 0:4.2.20-202002170402.git.1.43218bc.el7
containers-common< 1:0.1.32-6.git1715c90.el8_0
cri-o< 0:1.14.12-19.dev.rhaos4.2.git313d784.el7 | < 0:1.14.12-10.dev.rhaos4.2.git313d784.el8 | < 0:1.13.12-6.dev.rhaos4.1.git8abaaeb.el7 | < 0:1.13.12-6.dev.rhaos4.1.git8abaaeb.el8_0

cri-o-debuginfo< 0:1.14.12-10.dev.rhaos4.2.git313d784.el8 | < 0:1.13.12-6.dev.rhaos4.1.git8abaaeb.el7 | < 0:1.13.12-6.dev.rhaos4.1.git8abaaeb.el8_0
cri-o-debugsource< 0:1.14.12-10.dev.rhaos4.2.git313d784.el8 | < 0:1.13.12-6.dev.rhaos4.1.git8abaaeb.el8_0
jenkins< 0:2.204.1.1581951349-1.el7 | < 0:2.204.2.1583849753-1.el7
jenkins-2-plugins< 0:4.2.1581952573-1.el7 | < 0:4.1.1583850385-1.el7
machine-config-daemon< 0:4.2.20-202002170402.git.1.a83336a.el8
openshift< 0:4.2.20-202002140432.git.0.47933cb.el7 | < 0:4.2.20-202002140432.git.0.47933cb.el8 | < 0:4.1.37-202002280447.git.0.543873e.el7 | < 0:4.1.37-202002280447.git.0.543873e.el8_0
openshift-ansible< 0:4.2.20-202002140432.git.187.2308b53.el7 | < 0:4.1.37-202002280447.git.1.bb180eb.el7
openshift-clients< 0:4.2.20-202002140432.git.1.5dc67c9.el7 | < 0:4.2.20-202002140432.git.1.5dc67c9.el8 | < 0:4.1.37-202002280447.git.0.543873e.el7 | < 0:4.1.37-202002280447.git.0.543873e.el8_0
openshift-clients-redistributable< 0:4.2.20-202002140432.git.1.5dc67c9.el7 | < 0:4.2.20-202002140432.git.1.5dc67c9.el8 | < 0:4.1.37-202002280447.git.0.543873e.el7 | < 0:4.1.37-202002280447.git.0.543873e.el8_0
openshift-hyperkube< 0:4.2.20-202002140432.git.0.47933cb.el7 | < 0:4.2.20-202002140432.git.0.47933cb.el8 | < 0:4.1.37-202002280447.git.0.543873e.el7 | < 0:4.1.37-202002280447.git.0.543873e.el8_0
openshift-kuryr< 0:4.2.20-202002140432.git.1.d9a72a5.el7
openshift-kuryr-cni< 0:4.2.20-202002140432.git.1.d9a72a5.el7
openshift-kuryr-common< 0:4.2.20-202002140432.git.1.d9a72a5.el7
openshift-kuryr-controller< 0:4.2.20-202002140432.git.1.d9a72a5.el7
podman< 0:1.0.2-3.dev.git96ccc2e.el8_0
podman-debuginfo< 0:1.0.2-3.dev.git96ccc2e.el8_0
podman-debugsource< 0:1.0.2-3.dev.git96ccc2e.el8_0
podman-docker< 0:1.0.2-3.dev.git96ccc2e.el8_0
python2-kuryr-kubernetes< 0:4.2.20-202002140432.git.1.d9a72a5.el7
runc< 0:1.0.0-63.rc8.rhaos4.1.git3cbe540.el8_0
runc-debuginfo< 0:1.0.0-63.rc8.rhaos4.1.git3cbe540.el8_0
runc-debugsource< 0:1.0.0-63.rc8.rhaos4.1.git3cbe540.el8_0
skopeo< 1:0.1.32-6.git1715c90.el8_0
skopeo-debuginfo< 1:0.1.32-6.git1715c90.el8_0
skopeo-debugsource< 1:0.1.32-6.git1715c90.el8_0

Show all 30

Jenkins1 product

git_client≤ 2.8.4 | 3.0.0:rc

Jenkins project1 product

jenkins git client plugin2.8.4 and earlier, 3.0.0-rc

Org.jenkins-ci.plugins1 product

git-client< 2.8.5

4 vendors · 33 products

References

13 links

jenkins.io/security/advisory/2019-09-12/X Refsource MISCVendor AdvisoryARTICLEWEB
www.openwall.com/lists/oss-security/2019/09/12/2Mailing ListX Refsource MLISTThird Party AdvisoryWEB
access.redhat.com/errata/RHBA-2020:0522Advisory
bugzilla.redhat.com/show_bug.cgi?id=1802082REPORT
security.access.redhat.com/data/csaf/v2/advisories/2020/rhba-2020_0522.jsonAdvisory
access.redhat.com/security/cve/CVE-2019-10392REPORT
bugzilla.redhat.com/show_bug.cgi?id=1819704REPORT
www.cve.org/CVERecord?id=CVE-2019-10392Advisory
nvd.nist.gov/vuln/detail/CVE-2019-10392Advisory
access.redhat.com/errata/RHBA-2020:0690Advisory

Show all 13 references

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities