Medium WID-SEC-2023-0432 4 CVEs

Jenkins: Mehrere Schwachstellen

Published Oct 6, 2021 · Updated Feb 20, 2023 · Revision 4 · de-DE

Vendor: Jenkins Project Vendor: Red Hat Product: Enterprise Linux Product: Jenkins Product: Jenkins < 2.315 Product: Jenkins < LTS 2.303.2 Product: Jenkins Plugins Product: OpenShift Container Platform 4.12 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Dateien zu manipulieren oder einen Cross-Site-Scripting-Angriff durchzuführen.

Product

Jenkins ist ein erweiterbarer, webbasierter Integration Server zur kontinuierlichen Unterstützung bei Softwareentwicklungen aller Art.

Vulnerabilities 4

Medium 6.5

CVE-2021-21683

Path traversal vulnerability on Windows in Jenkins

The file browser in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier may interpret some paths to files as absolute on Windows, resulting in a path traversal vulnerability allowing attackers with Overall/Read permission (Windows controller) or Job/Workspace …

Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven

Oct 6, 2021
Medium 6.3

CVE-2021-21682

Improper handling of equivalent directory names on Windows in Jenkins

Jenkins 2.314 and earlier, LTS 2.303.1 and earlier accepts names of jobs and other entities with a trailing dot character, potentially replacing the configuration and data of other entities on Windows.

Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven

Oct 6, 2021
Medium 6.1

CVE-2021-21684

Stored XSS vulnerability in Jenkins Git Plugin

Jenkins Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notifications when displaying them in a build cause, resulting in a stored cross-site scripting (XSS) vulnerability.

Jenkins Project Jenkins Git Plugin git org.jenkins-ci.plugins:git Web / CMS Azure Linux Maven

Oct 6, 2021
Medium —

CVE-2014-3577

Improper Verification of Cryptographic Signature in org.apache.httpcomponents:httpclient

org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of th…

org.apache.httpcomponents:httpclient httpcomponents-client httpcomponents-client commons-httpclient Debian Ubuntu Maven

Aug 21, 2014

Revision history

2023-02-20 #4
Neue Updates von Red Hat aufgenommen
2022-03-10 #3
Neue Updates von Red Hat aufgenommen
2021-10-07 #2
Referenz(en) aufgenommen: 2011949
2021-10-06 #1
Initiale Fassung

References

Red Hat Security Advisory RHSA-2023:0769 vom 2023-02-21
https://access.redhat.com/errata/RHSA-2023:0769
Jenkins Security Advisory vom 2021-10-06
https://www.jenkins.io/security/advisory/2021-10-06/
Red Hat Security Advisory RHSA-2022:0055 vom 2022-03-10
https://access.redhat.com/errata/RHSA-2022:0055
Red Hat Security Advisory RHSA-2022:0056 vom 2022-03-10
https://access.redhat.com/errata/RHSA-2022:0056