Jenkins: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• High 8.8
  CVE-2024-43044 Public exploit EPSS 29%

  Jenkins Remoting library arbitrary file read vulnerability

  Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by using the `ClassLoaderProxy#fetchJar` method in the Remoting library.

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core org.jenkins-ci.main:remoting Web / CMS Maven
  Aug 7, 2024
• Medium 6.3
  CVE-2024-43045

  Jenkins does not perform a permission check in an HTTP endpoint

  Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to access other users' "My Views".

  Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  Aug 7, 2024

Revision history

1. 2024-08-14 #2

   Neue Updates von Red Hat aufgenommen

2. 2024-08-07 #1

   Initiale Fassung

References

• Jenkins Security Advisory vom 2024-08-07
  https://www.jenkins.io/security/advisory/2024-08-07/
• Red Hat Security Advisory RHSA-2024:5411 vom 2024-08-15
  https://access.redhat.com/errata/RHSA-2024:5411
• Red Hat Security Advisory RHSA-2024:5406 vom 2024-08-15
  https://access.redhat.com/errata/RHSA-2024:5406
• Red Hat Security Advisory RHSA-2024:5405 vom 2024-08-15
  https://access.redhat.com/errata/RHSA-2024:5405
• Red Hat Security Advisory RHSA-2024:5410 vom 2024-08-15
  https://access.redhat.com/errata/RHSA-2024:5410