CVE-2018-1999044 Infinite Loop in Jenkins Core
Attackers with read permissions can cause a denial of service by triggering an infinite loop in Jenkins request handling threads.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-1999044?
CVE-2018-1999044 is a medium-severity denial of service vulnerability in Jenkins Jenkins, published on 23 Aug 2018. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A denial of service vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in CronTab.java that allows attackers with Overall/Read permission to have a request handling thread enter an infinite loop.
Weakness: CWE-835
Which versions are affected by CVE-2018-1999044?
2 open source packages ship an affected version, including org.jenkins-ci.main:jenkins-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.main:jenkins-core Maven | All versions | 2.138 |
org.jenkins-ci.main:jenkins-core Maven | All versions | 2.138 |
Products include Jenkins Jenkins.
How do I fix CVE-2018-1999044?
Upgrade org.jenkins-ci.main:jenkins-core to 2.138 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-1999044 being exploited?
There is no known exploitation of CVE-2018-1999044 in the wild and no public exploit code.
Other vulnerabilities in Jenkins Jenkins
- CVE-2024-23897 Jenkins Command Line Interface (CLI) Path Traversal
- CVE-2018-1000861 Jenkins Stapler Web Framework Deserialization of Untrusted Data
- CVE-2017-1000353 Jenkins Remote Code Execution
- CVE-2015-5317 Jenkins User Interface (UI) Information Disclosure
- CVE-2021-21690 Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
Sources
Also known as GHSA-8qpf-fv36-h4r8.