CVE-2018-1000055: XXE vulnerability in Jenkins Android Lint Plugin
Summary
CVE-2018-1000055: XXE vulnerability in Jenkins Android Lint Plugin. Affects org.jvnet.hudson.plugins:android-lint versions < 2.6. Fixed in 2.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Android Lint Plugin is a Maven package that is used in the build process of Jenkins. It is responsible for processing XML files and performing linting on Android projects. The plugin helps identify and fix issues in Android code, improving the quality of the build. However, versions 2.5 and earlier of the plugin are vulnerable to an XML External Entity (XXE) attack.
Vulnerability Detail
The XXE vulnerability in Jenkins Android Lint Plugin allows attackers with user permissions in Jenkins to exploit XML external entities in files parsed during the build process. This can lead to several security risks, including the extraction of sensitive information from the Jenkins master, server-side request forgery, and denial-of-service attacks. The vulnerability has a CVSS score of 8.3, indicating a high severity level.
How To Fix
Minimum fixed version
2.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The XXE vulnerability in Jenkins Android Lint Plugin can have severe consequences, including the extraction of sensitive information and the possibility of server-side request forgery and denial-of-service attacks. It is crucial to upgrade to version 2.6 or later of the plugin to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.jvnet.hudson.plugins:android-lint →
FAQ
The vulnerability allows attackers to extract sensitive information, perform server-side request forgery, or launch denial-of-service attacks.
Users of Jenkins Android Lint Plugin versions 2.5 and earlier are affected by this vulnerability.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software.
Yes, upgrading to Jenkins Android Lint Plugin version 2.6 or later will fix the vulnerability.
You can find more information about this vulnerability in the GitHub Advisory Database (https://github.com/github/advisory-database).
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jvnet.hudson.plugins:android-lint.
