CVE-2012-0785 Hash collision attack vulnerability in Jenkins
HighCVSS 7.5
EPSS 3.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Hash collision attack vulnerability in Jenkins before 1.447, Jenkins LTS before 1.424.2, and Jenkins Enterprise by CloudBees 1.424.x before 1.424.2.1 and 1.400.x before 1.400.0.11 could allow remote attackers to cause a considerable CPU load, aka "the Hash DoS attack."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.jenkins-ci.main/jenkins-core(Maven) | >= 1.425, < 1.447 | 1.447 |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.425 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.426 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.427 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.428 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.429 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.430 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.431 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.432 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.433 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.434 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.435 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.436 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.437 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.438 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.439 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.440 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.441 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.442 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.443 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.444 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.445 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.446 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | < 1.424.2 | 1.424.2 |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.396 | No fix listed |
Show 39 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.397 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.398 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.399 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.400 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.401 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.403 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.404 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.405 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.406 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.407 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.408 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.409 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.409.1 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.409.2 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.409.3 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.410 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.411 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.412 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.413 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.414 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.415 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.416 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.417 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.418 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.419 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.420 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.421 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.422 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.423 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.424 | No fix listed |
| org.jenkins-ci.main/jenkins-core(Maven) | = 1.424.1 | No fix listed |
| Jenkins Project Jenkins | = before 1.447 | No fix listed |
| Jenkins Project Jenkins LTS | = before 1.424.2 | No fix listed |
| Jenkins Project Jenkins Enterprise by CloudBees | = 1.424.x before 1.424.2.1 | No fix listed |
| Jenkins Project Jenkins Enterprise by CloudBees | = 1.400.x before 1.400.0.11 | No fix listed |
| cloudbees jenkins | >= 1.400.0, < 1.400.0.11 | 1.400.0.11 |
| cloudbees jenkins | >= 1.424.0, < 1.424.2.1 | 1.424.2.1 |
| jenkins | < 1.424.2 | 1.424.2 |
| jenkins | < 1.447 | 1.447 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- access.redhat.com broken-link
- jenkins.io vendor-advisory
- security-tracker.debian.org third-party-advisory
- www.cloudbees.com third-party-advisory
- [oss-security] 20120119 Re: CVE request: Jenkins mailing-list third-party-advisory
- github.com