Jenkins before 1.638 and LTS before 1.625.2 do not properly verify the shared secret used in JNLP slave connections, which allows remote attackers to connect as slaves and obtain sensitive information or possibly gain administrative access by leveraging knowledge of the name of a slave.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Jenkins 2015 11 11 | — | Upgrade Jenkins LTS to the latest versionUpgrade Jenkins to version 1.638Upgrade Jenkins LTS to version 1.625.2Upgrade Jenkins to the latest version | Nov 13, 2017 | Nov 25, 2015 |
| Redhat Openshift | — | Upgrade nodejs-es6-promiseUpgrade nodejs-map-streamUpgrade nodejs-preserveUpgrade nodejs-registry-urlUpgrade nodejs-string-lengthUpgrade rubygem-openshift-origin-commonUpgrade nodejs-binary-extensionsUpgrade rubygem-openshift-origin-nodeUpgrade nodejs-ansi-wrapUpgrade nodejs-capture-stack-traceUpgrade nodejs-parse-globUpgrade nodejs-fill-rangeUpgrade phpUpgrade nodejs-throughUpgrade nodejs-unzip-responseUpgrade nodejs-is-npmUpgrade nodejs-lodash.restparamUpgrade nodejs-lodash.assignUpgrade nodejs-ps-treeUpgrade nodejs-rcUpgrade nodejs-os-homedirUpgrade nodejs-xdg-basedirUpgrade nss_wrapperUpgrade nodejs-is-streamUpgrade nodejs-randomaticUpgrade nodejs-success-symbolUpgrade openshift-origin-node-utilUpgrade nodejs-latest-versionUpgrade nodejs-expand-bracketsUpgrade openshift-origin-node-proxyUpgrade openshift-origin-cartridge-phpUpgrade nodejs-lodash.bindcallbackUpgrade rubygem-openshift-origin-frontend-apache-vhostUpgrade nodejs-is-extendableUpgrade nodejs-osenvUpgrade openshift-origin-cartridge-mysqlUpgrade nodejs-glob-parentUpgrade nodejs-lowercase-keysUpgrade openshift-ansibleUpgrade rubygem-openshift-origin-consoleUpgrade activemqUpgrade nodejs-glob-baseUpgrade nodejs-splitUpgrade nodejs-is-binary-pathUpgrade nodejs-package-jsonUpgrade nodejs-write-file-atomicUpgrade nodejs-anymatchUpgrade nodejs-slideUpgrade nodejs-readdirpUpgrade openshift-origin-msg-node-mcollectiveUpgrade nodejs-undefsafeUpgrade nodejs-extglobUpgrade openshift-enterprise-upgradeUpgrade nodejs-configstoreUpgrade origin-kibanaUpgrade nodejs-optimistUpgrade rubygem-openshift-origin-controllerUpgrade nodejs-lazy-cacheUpgrade nodejs-kind-ofUpgrade nodejs-event-streamUpgrade nodejs-iniUpgrade nodejs-bracesUpgrade nodejs-nodemonUpgrade nodejs-deep-extendUpgrade nodejs-duplexifyUpgrade nodejs-filename-regexUpgrade nodejs-normalize-pathUpgrade nodejs-update-notifierUpgrade nodejs-lodash.defaultsUpgrade nodejs-lodash.basecopyUpgrade nodejs-is-dotfileUpgrade nodejs-pinkieUpgrade nodejs-graceful-fsUpgrade openshift-origin-cartridge-cronUpgrade jenkinsUpgrade nodejs-object-assignUpgrade nodejs-is-equal-shallowUpgrade nodejs-lodash.isarrayUpgrade nodejs-arr-flattenUpgrade nodejs-is-numberUpgrade nodejs-strip-json-commentsUpgrade nodejs-arr-diffUpgrade openshift-origin-broker-utilUpgrade nodejs-stream-combinerUpgrade nodejs-expand-rangeUpgrade nodejs-pause-streamUpgrade nodejs-create-error-classUpgrade nodejs-is-redirectUpgrade heapsterUpgrade nodejs-touchUpgrade openshift-origin-cartridge-pythonUpgrade nodejs-mkdirpUpgrade openvswitchUpgrade nodejs-uuidUpgrade nodejs-url-parse-laxUpgrade nodejs-arrifyUpgrade nodejs-pinkie-promiseUpgrade nodejs-lodash.isiterateecallUpgrade nodejs-lodash.isargumentsUpgrade nodejs-regex-cacheUpgrade nodejs-read-all-streamUpgrade nodejs-gotUpgrade nodejs-lodash.getnativeUpgrade nodejs-end-of-streamUpgrade nodejs-repeat-elementUpgrade nodejs-semverUpgrade nodejs-align-textUpgrade nodejs-array-uniqueUpgrade nodejs-lodash.keysUpgrade nodejs-async-eachUpgrade nodejs-isobjectUpgrade nodejs-is-globUpgrade nodejs-is-primitiveUpgrade nodejs-is-extglobUpgrade openshift-origin-cartridge-haproxyUpgrade nodejs-timed-outUpgrade nodejs-semver-diffUpgrade nodejs-duplexerUpgrade rhcUpgrade nodejs-lodash.createassignerUpgrade atomic-openshiftUpgrade nodejs-object.omitUpgrade nodejs-for-ownUpgrade nodejs-chokidarUpgrade nodejs-lodash.baseassignUpgrade nodejs-node-status-codesUpgrade nodejs-os-tmpdirUpgrade nodejs-micromatchUpgrade nodejs-fromUpgrade nodejs-parse-jsonUpgrade nodejs-error-exUpgrade nodejs-ansi-greenUpgrade nodejs-is-plain-objUpgrade nodejs-prepend-httpUpgrade nodejs-for-in | Jun 18, 2018 | Nov 11, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub