CVE Vulnerability Catalog

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in tooltips of breadcrumb bar overflow menu entries. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Read permission.

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller. This results in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory. This results in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including login passwords.

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins using a "remember me" cookie after the API token is revoked or expires.

In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting in a race condition that allows unauthenticated attackers to create an administrator account while the initial user account is being replaced.

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and allows symbolic links in artifacts to replace existing files or empty directories, allowing attackers with Item/Configure permission to write files to arbitrary locations on the Jenkins controller file system.

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.xml file on the controller file system as an agent configuration, and to overwrite an arbitrary config.xml file when that agent is saved, potentially resulting in arbitrary code execution.

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with Item/Create and Item/Configure permission to read arbitrary files on the Jenkins controller file system.

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they have been approved by an administrator, allowing attackers with Agent/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers with access to POST config.xml API endpoints to submit crafted config.xml files that can lead to, e.g., stored cross-site scripting (XSS) vulnerabilities.

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` attribute during XStream deserialization. This may allow bypassing the filter and deserializing dangerous classes.

A vulnerability in Apache Kafka Connect affects the REST API endpoint /connector-plugins/{connector-type}/config/validate used to validate connector configurations. An attacker with access to this endpoint can leverage installed Configuration Providers to resolve and return plaintext values of sensitive configuration that should only be resolved at runtime.

Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners is configured as a separate listener from the main listeners property. REST extensions specified via rest.extension.classes (such as BasicAuthSecurityRestExtension) are not registered or applied to the admin resource configuration, so the /admin/loggers endpoint accepts unauthenticated read and write requests.

A vulnerability in Apache Kafka allows an authenticated producer with Write permission on a topic to declare a decompressed body size of up to about 2 GiB in a compressed record, forcing a buffer allocation and causing an OutOfMemoryError. This can crash broker request-handler threads, consumers, and permanently stop the log-cleaner thread on compacted topics.

An authenticated Kafka principal with no authorization grants can make a broker read a file or environment variable from the broker host and return its contents. An IncrementalAlterConfigs or AlterConfigs request targeting a BROKER resource reaches configuration validation before any authorization check, and configuration-variable resolution (${file:...}, ${env:...}) bypasses the config-providers allowlist added as mitigation for CVE-2024-31141.

Several Apache Kafka deserialization paths read a size or count field from input data and use it directly to allocate an array, collection, or byte buffer without checking the bytes actually available. A small crafted input can declare a very large size and force a multi-gigabyte allocation, causing an OutOfMemoryError. Affected paths include ProcessorRecordContext, ChangedDeserializer, CombinedKeySchema, ProcessorMetadata, and AssignmentInfo in Kafka Streams, and ListDeserializer in the clients library.

A vulnerability in Kafka Streams involves arithmetic overflow when computing the next punctuation time. A record with a timestamp near Long.MAX_VALUE causes the next stream-time punctuation to overflow to a negative value, leading to an infinite loop in PunctuationQueue while holding a lock and stalling the StreamThread.

A vulnerability in Apache Kafka's code-generated readers for flexible protocol versions reads a tagged-field count declared by the sender and retains a RawTaggedField object for each unknown field. The count was bounded only by the outer request frame size, not by remaining buffer bytes or a fixed cap, allowing a modest request to declare tens of millions of tagged fields and force one object allocation per field. Flexible request headers are parsed before authorization, so the amplification applies pre-authentication.

Apache Kafka's code-generated protocol readers pre-size an array's collection from the element count declared by the sender, checked only against the bytes remaining in the request buffer (assuming about one byte per element). For a keyed array the reader allocates an ImplicitLinkedHashCollection of capacity (2 * count + 1), so a request of a few tens of megabytes can force a heap allocation several times larger before any element is read. The pattern affects all Kafka API types with an array field.