Skip to content
Fencer Intel
high 8.8

CVE-2019-10392 in the critical feed json

Improper Neutralization of Special Elements used in an OS Command in Jenkins Git Client Plugin

published 7y ago modified 4mo ago also GHSA-hw6x-2qwv-rxr7 , EUVD-2022-4225

cvss
8.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
23.1%
EPSS 23.1% chance of exploitation in 30 days, percentile 97%
public exploits
0
none known

Summary

Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of 'git ls-remote', resulting in OS command injection.

Patch / fix

  • maven org.jenkins-ci.plugins:git-client 2.8.5
  • jenkins-2-plugins openshift 3.11 3.11.1591354111-1.el7
  • cri-o openshift 4.3 1.16.3-20.dev.rhaos4.3.git11c04e3.el7
  • cri-o openshift 4.3 1.16.3-22.dev.rhaos4.3.git11c04e3.el8
  • dracut openshift 4.3 049-64.git20200123.el8
  • jenkins openshift 4.3 2.204.1.1581950993-1.el7
  • toolbox openshift 4.3 0.0.6-1.rhaos4.3.el8
  • cri-tools openshift 4.3 1.17.0-1.el8
  • openshift openshift 4.3 4.3.3-202002140552.git.0.e38059c.el7

red hat advisories RHSA-2020:2478RHBA-2020:0527RHBA-2020:0522RHBA-2020:0690

Is CVE-2019-10392 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-10392 updated cvss 8.8

jenkins-git-client-plugin: OS command injection via 'git ls-remote'

  • Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins 3.11.1591354111-1.el7
    fixed: vendor fix RHSA-2020:2478
  • Red Hat OpenShift Container Platform 4.1 jenkins 2.204.2.1583849753-1.el7, skopeo 0.1.32-6.git1715c90.el8_0, podman 1.0.2-3.dev.git96ccc2e.el8_0, jenkins-2-plugins 4.1.1583850385-1.el7, podman-docker 1.0.2-3.dev.git96ccc2e.el8_0, containers-common 0.1.32-6.git1715c90.el8_0, +14 more
    fixed: vendor fix RHBA-2020:0690
  • Red Hat OpenShift Container Platform 4.2 jenkins 2.204.1.1581951349-1.el7, jenkins-2-plugins 4.2.1581952573-1.el7, cri-o 1.14.12-10.dev.rhaos4.2.git313d784.el8, cri-o 1.14.12-19.dev.rhaos4.2.git313d784.el7, openshift 4.2.20-202002140432.git.0.47933cb.el7, openshift 4.2.20-202002140432.git.0.47933cb.el8, +16 more
    fixed: vendor fix RHBA-2020:0522
  • Red Hat OpenShift Container Platform 4.3 cri-tools 1.17.0-1.el8, toolbox 0.0.6-1.rhaos4.3.el8, dracut 049-64.git20200123.el8, jenkins 2.204.1.1581950993-1.el7, dracut-caps 049-64.git20200123.el8, dracut-live 049-64.git20200123.el8, +28 more
    fixed: vendor fix RHBA-2020:0527

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

23.08% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P
GitHub 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven org.jenkins-ci.plugins:git-client
<2.8.5
2.8.5

Affected products

  • Jenkins project Jenkins Git Client Plugin

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.