The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents, which can be used to connect to Jenkins, impersonating those agents.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade jenkinsUpgrade jenkins-lts | Jan 30, 2020 | Jan 29, 2020 |
| Jenkins 2020 01 29 | — | Upgrade Jenkins to version 2.219Upgrade Jenkins LTS to version 2.204.2Upgrade Jenkins LTS to the latest versionUpgrade Jenkins to the latest version | Jan 30, 2020 | Jan 29, 2020 |
| Redhat Openshift | — | Upgrade openshift-kuryrUpgrade atomic-openshift-node-problem-detectorUpgrade golang-github-prometheus-prometheusUpgrade cri-oUpgrade atomic-openshift-web-consoleUpgrade openshift-ansibleUpgrade atomic-openshiftUpgrade golang-github-openshift-oauth-proxyUpgrade openshift-enterprise-cluster-capacityUpgrade atomic-openshift-service-idlerUpgrade jenkinsUpgrade golang-github-prometheus-alertmanagerUpgrade atomic-openshift-metrics-serverUpgrade atomic-enterprise-service-catalogUpgrade atomic-openshift-cluster-autoscalerUpgrade atomic-openshift-deschedulerUpgrade openshift-enterprise-autohealUpgrade jenkins-2-pluginsUpgrade atomic-openshift-dockerregistryUpgrade golang-github-prometheus-node_exporter | Mar 18, 2020 | Jan 29, 2020 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub