Threats tagged 'ghsa-qrh5-jg98-cr48'

Jenkins versions 2.527 and earlier, including LTS 2.516.2 and earlier, have a log message injection vulnerability where user-controlled input in log messages can include line break characters. This allows attackers to insert forged log entries that may mislead administrators. Fixed in Jenkins 2.516.3 and 2.528 by adding indicators for inserted line breaks in log output.