CVE-2019-10392: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

May 24, 2022 (updated June 28, 2022)

Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc does not properly restrict values passed as URL argument to an invocation of ‘git ls-remote’, resulting in OS command injection.

References

www.openwall.com/lists/oss-security/2019/09/12/2
github.com/advisories/GHSA-hw6x-2qwv-rxr7
jenkins.io/security/advisory/2019-09-12/
nvd.nist.gov/vuln/detail/CVE-2019-10392

Code Behaviors & Features

Detect and mitigate CVE-2019-10392 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →