Skip to content

Commit 23e9441

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-6837-qgrc-x5p6 GHSA-hxjg-2jvf-h3rx GHSA-v8hg-m323-jvjq GHSA-6837-qgrc-x5p6 GHSA-hxjg-2jvf-h3rx
1 parent be107d1 commit 23e9441

File tree

5 files changed

+201
-76
lines changed

5 files changed

+201
-76
lines changed

‎advisories/github-reviewed/2025/12/GHSA-6837-qgrc-x5p6/GHSA-6837-qgrc-x5p6.json‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6837-qgrc-x5p6",
4+
"modified": "2025-12-10T20:14:45Z",
5+
"published": "2025-12-10T18:30:26Z",
6+
"aliases": [
7+
"CVE-2025-67639"
8+
],
9+
"summary": "Jenkins has a CSRF vulnerability on the login form",
10+
"details": "A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the attacker's account.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.jenkins-ci.main:jenkins-core"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "2.529"
29+
},
30+
{
31+
"fixed": "2.541"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Maven",
40+
"name": "org.jenkins-ci.main:jenkins-core"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "0"
48+
},
49+
{
50+
"fixed": "2.528.3"
51+
}
52+
]
53+
}
54+
]
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "ADVISORY",
60+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67639"
61+
},
62+
{
63+
"type": "WEB",
64+
"url": "https://github.com/jenkinsci/jenkins/commit/31598feb0aa514d8978d2c27a4c9a5a9b8d80a57"
65+
},
66+
{
67+
"type": "PACKAGE",
68+
"url": "https://github.com/jenkinsci/jenkins"
69+
},
70+
{
71+
"type": "WEB",
72+
"url": "https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-1166"
73+
}
74+
],
75+
"database_specific": {
76+
"cwe_ids": [
77+
"CWE-352"
78+
],
79+
"severity": "LOW",
80+
"github_reviewed": true,
81+
"github_reviewed_at": "2025-12-10T20:14:45Z",
82+
"nvd_published_at": "2025-12-10T17:15:56Z"
83+
}
84+
}

‎advisories/github-reviewed/2025/12/GHSA-hxjg-2jvf-h3rx/GHSA-hxjg-2jvf-h3rx.json‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hxjg-2jvf-h3rx",
4+
"modified": "2025-12-10T20:15:05Z",
5+
"published": "2025-12-10T18:30:26Z",
6+
"aliases": [
7+
"CVE-2025-67638"
8+
],
9+
"summary": "Jenkins's build authorization token is stored and displayed in plain text",
10+
"details": "Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.jenkins-ci.main:jenkins-core"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "2.529"
29+
},
30+
{
31+
"fixed": "2.541"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Maven",
40+
"name": "org.jenkins-ci.main:jenkins-core"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "0"
48+
},
49+
{
50+
"fixed": "2.528.3"
51+
}
52+
]
53+
}
54+
]
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "ADVISORY",
60+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67638"
61+
},
62+
{
63+
"type": "WEB",
64+
"url": "https://github.com/jenkinsci/jenkins/commit/4710d65339251aaf1d1599f19545db99be24d981"
65+
},
66+
{
67+
"type": "PACKAGE",
68+
"url": "https://github.com/jenkinsci/jenkins"
69+
},
70+
{
71+
"type": "WEB",
72+
"url": "https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-783"
73+
}
74+
],
75+
"database_specific": {
76+
"cwe_ids": [
77+
"CWE-312"
78+
],
79+
"severity": "MODERATE",
80+
"github_reviewed": true,
81+
"github_reviewed_at": "2025-12-10T20:15:05Z",
82+
"nvd_published_at": "2025-12-10T17:15:56Z"
83+
}
84+
}

advisories/unreviewed/2025/12/GHSA-v8hg-m323-jvjq/GHSA-v8hg-m323-jvjq.json renamed to advisories/github-reviewed/2025/12/GHSA-v8hg-m323-jvjq/GHSA-v8hg-m323-jvjq.json

Lines changed: 33 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,53 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-v8hg-m323-jvjq",
4-
"modified": "2025-12-10T18:30:26Z",
4+
"modified": "2025-12-10T20:14:28Z",
55
"published": "2025-12-10T18:30:26Z",
66
"aliases": [
77
"CVE-2025-67640"
88
],
9+
"summary": "Jenkins Git client Plugin has an OS command injection vulnerability on agents in Git client Plugin",
910
"details": "Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a temporary shell script generated by the plugin, allowing attackers able to control the workspace directory name to inject arbitrary OS commands.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.jenkins-ci.plugins:git-client"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "6.4.1"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
2041
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67640"
2142
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/jenkinsci/git-client-plugin/commit/5a271e5d1d08bd45cdb3c3541856d2dc2abf0dbc"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/jenkinsci/git-client-plugin"
50+
},
2251
{
2352
"type": "WEB",
2453
"url": "https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-3614"
@@ -29,8 +58,8 @@
2958
"CWE-78"
3059
],
3160
"severity": "MODERATE",
32-
"github_reviewed": false,
33-
"github_reviewed_at": null,
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2025-12-10T20:14:28Z",
3463
"nvd_published_at": "2025-12-10T17:15:56Z"
3564
}
3665
}

‎advisories/unreviewed/2025/12/GHSA-6837-qgrc-x5p6/GHSA-6837-qgrc-x5p6.json‎

Lines changed: 0 additions & 36 deletions
This file was deleted.

‎advisories/unreviewed/2025/12/GHSA-hxjg-2jvf-h3rx/GHSA-hxjg-2jvf-h3rx.json‎

Lines changed: 0 additions & 36 deletions
This file was deleted.

0 commit comments

Comments
 (0)