An information exposure and denial of service vulnerability exists in Jenkins Token Macro Plugin 2.5 and earlier in src/main/java/org/jenkinsci/plugins/tokenmacro/Parser.java, src/main/java/org/jenkinsci/plugins/tokenmacro/TokenMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/AbstractChangesSinceMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ChangesSinceLastBuildMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ProjectUrlMacro.java that allows attackers with the ability to control token macro input (such as SCM changelogs) to define recursive input that results in unexpected macro evaluation.

Affected: Maven: org.jenkins-ci.plugins:token-macro

Jenkins Token Macro Plugin recursively applied token expansion.

This could be used by users able to affect input to token expansion (such as change log messages), to inject additional tokens into the input, which would then be expanded, resulting in information disclosure (for example values of environment variables), or denial of service.

Most tokens have been changed to no longer recursively apply token expansion.

haproxy: Out-of-bounds read in dns.c:dns_validate_dns_response() allows for memory disclosure haproxy: Infinite recursion via crafted packet allows stack exhaustion and denial of service haproxy: Mishandling of priority flag in short HEADERS frame by HTTP/2 decoder allows for crash jenkins-plugin-script-security: Sandbox Bypass in finalize methods jenkins-plugin-script-security: Sandbox Bypass in finalize methods prometheus: Stored DOM cross-site scripting (XSS) attack via crafted URL jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin jenkins-plugin-workflow-cps: Sandbox Bypass in Pipeline: Groovy Plugin jenkins-plugin-pipeline-model-definition: Sandbox Bypass in Pipeline: Declarative jenkins: cookie crafted using Jenkins script console allows unauthorised access to Jenkins instance jenkins: deleting a user record will does not invalidate existing sessions jenkins-plugin-git: CSRF vulnerability in Git Plugin (SECURITY-1095) jenkins-plugin-token-macro: Recursive token expansion results in information disclosure and DoS in Token Macro Plugin (SECURITY-1102) jenkins-plugin-blueocean: Blue Ocean did not require CSRF tokens (SECURITY-1201) jenkins-plugin-blueocean: XSS vulnerability via user description in Blue Ocean (SECURITY-1204) jenkins-plugin-config-file-provider: Stored XSS vulnerability in Config File Provider Plugin (SECURITY-1253)