CVE-2019-1003003 — Improper Authorization in Jenkins Core

Description

An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java that allows attackers with Overall/RunScripts permission to craft Remember Me cookies that would never expire, allowing e.g. to persist access to temporarily compromised user accounts.

Affected products

Vendor	Product	Affected	Fixed
Jenkins project	Jenkins	2.158 and earlier, LTS 2.150.1 and earlier	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
Red Hat OpenShift 3	atomic-enterprise-service-catalog +1	1:3.11.82-1.git.1673.133961e.el7	RHBA-2019:0326
Red Hat OpenShift 3	atomic-openshift +12	3.11.82-1.git.0.08bc31b.el7	RHBA-2019:0326
Red Hat OpenShift 3	atomic-openshift-cluster-autoscaler	3.11.82-1.git.0.efb6af0.el7	RHBA-2019:0326
Red Hat OpenShift 3	atomic-openshift-descheduler	3.11.82-1.git.300.89765c9.el7	RHBA-2019:0326
Red Hat OpenShift 3	atomic-openshift-dockerregistry	3.11.82-1.git.452.0ce6383.el7	RHBA-2019:0326
Red Hat OpenShift 3	atomic-openshift-metrics-server	3.11.82-1.git.52.2fdca3f.el7	RHBA-2019:0326
Red Hat OpenShift 3	atomic-openshift-node-problem-detector	3.11.82-1.git.254.a448936.el7	RHBA-2019:0326
Red Hat OpenShift 3	atomic-openshift-service-idler	3.11.82-1.git.14.e353758.el7	RHBA-2019:0326
Red Hat OpenShift 3	atomic-openshift-web-console	3.11.82-1.git.355.5e8b1d9.el7	RHBA-2019:0326
Red Hat OpenShift 3	golang-github-openshift-oauth-proxy	3.11.82-1.git.425.7cac034.el7	RHBA-2019:0326
Red Hat OpenShift 3	haproxy +1	1.8.17-3.el7	RHBA-2019:0326
Red Hat OpenShift 3	jenkins	2.150.2.1549032159-1.el7	RHBA-2019:0326
Red Hat OpenShift 3	jenkins-2-plugins	3.11.1549642489-1.el7	RHBA-2019:0326
Red Hat OpenShift 3	openshift-ansible +4	3.11.82-3.git.0.9718d0a.el7	RHBA-2019:0326
Red Hat OpenShift 3	openshift-enterprise-autoheal	3.11.82-1.git.219.0b5aff4.el7	RHBA-2019:0326
Red Hat OpenShift 3	openshift-enterprise-cluster-capacity	3.11.82-1.git.380.cf11c51.el7	RHBA-2019:0326
Red Hat OpenShift 3	prometheus +1	3.11.82-1.git.5027.9d24833.el7	RHBA-2019:0326
Red Hat OpenShift 3	prometheus-alertmanager +1	3.11.82-1.git.0.3bf41ce.el7	RHBA-2019:0326
Red Hat OpenShift 3	prometheus-node-exporter +1	3.11.82-1.git.1063.48444e8.el7	RHBA-2019:0326

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.jenkins-ci.main:jenkins-core	< 2.150.2	2.150.2	GHSA-6rh5-23hx-j452
Maven	org.jenkins-ci.main:jenkins-core	>= 2.151, < 2.159	2.159	GHSA-6rh5-23hx-j452

Advisories 1

RHBA-2019:0326 Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix update Red Hat Security Advisories (RHSA) · Aug 5, 2026

References

https://jenkins.io/security/advisory/2019-01-16/#SECURITY-868
106680 vdb-entry
RHBA-2019:0327 vendor-advisory