Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents, which can be used to connect to Jenkins, impersonating those agents.
CVSS Details
- CVSS 3.1 Base Score: 8.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade jenkinsUpgrade jenkins-lts | Jan 30, 2020 | Jan 29, 2020 |
| Jenkins 2020 01 29 | — | Upgrade Jenkins to the latest versionUpgrade Jenkins LTS to version 2.204.2Upgrade Jenkins LTS to the latest versionUpgrade Jenkins to version 2.219 | Jan 30, 2020 | Jan 29, 2020 |
| Redhat Openshift | — | Upgrade openshift-enterprise-cluster-capacityUpgrade atomic-openshiftUpgrade openshift-ansibleUpgrade golang-github-prometheus-prometheusUpgrade golang-github-openshift-oauth-proxyUpgrade openshift-kuryrUpgrade cri-oUpgrade atomic-openshift-node-problem-detectorUpgrade atomic-openshift-web-consoleUpgrade atomic-openshift-dockerregistryUpgrade atomic-enterprise-service-catalogUpgrade atomic-openshift-cluster-autoscalerUpgrade atomic-openshift-metrics-serverUpgrade atomic-openshift-deschedulerUpgrade openshift-enterprise-autohealUpgrade golang-github-prometheus-alertmanagerUpgrade jenkins-2-pluginsUpgrade golang-github-prometheus-node_exporterUpgrade jenkinsUpgrade atomic-openshift-service-idler | Mar 18, 2020 | Jan 29, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub