CVE-2019-1003004 — Improper Authorization in Jenkins Core

Description

An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java that allows attackers to extend the duration of active HTTP sessions indefinitely even though the user account may have been deleted in the mean time.

Affected products

Vendor	Product	Affected	Fixed
Jenkins project	Jenkins	2.158 and earlier, LTS 2.150.1 and earlier	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
Red Hat OpenShift 3	atomic-enterprise-service-catalog +1	1:3.11.82-1.git.1673.133961e.el7	RHBA-2019:0326
Red Hat OpenShift 3	atomic-openshift +12	3.11.82-1.git.0.08bc31b.el7	RHBA-2019:0326
Red Hat OpenShift 3	atomic-openshift-cluster-autoscaler	3.11.82-1.git.0.efb6af0.el7	RHBA-2019:0326
Red Hat OpenShift 3	atomic-openshift-descheduler	3.11.82-1.git.300.89765c9.el7	RHBA-2019:0326
Red Hat OpenShift 3	atomic-openshift-dockerregistry	3.11.82-1.git.452.0ce6383.el7	RHBA-2019:0326
Red Hat OpenShift 3	atomic-openshift-metrics-server	3.11.82-1.git.52.2fdca3f.el7	RHBA-2019:0326
Red Hat OpenShift 3	atomic-openshift-node-problem-detector	3.11.82-1.git.254.a448936.el7	RHBA-2019:0326
Red Hat OpenShift 3	atomic-openshift-service-idler	3.11.82-1.git.14.e353758.el7	RHBA-2019:0326
Red Hat OpenShift 3	atomic-openshift-web-console	3.11.82-1.git.355.5e8b1d9.el7	RHBA-2019:0326
Red Hat OpenShift 3	golang-github-openshift-oauth-proxy	3.11.82-1.git.425.7cac034.el7	RHBA-2019:0326
Red Hat OpenShift 3	haproxy +1	1.8.17-3.el7	RHBA-2019:0326
Red Hat OpenShift 3	jenkins	2.150.2.1549032159-1.el7	RHBA-2019:0326
Red Hat OpenShift 3	jenkins-2-plugins	3.11.1549642489-1.el7	RHBA-2019:0326
Red Hat OpenShift 3	openshift-ansible +4	3.11.82-3.git.0.9718d0a.el7	RHBA-2019:0326
Red Hat OpenShift 3	openshift-enterprise-autoheal	3.11.82-1.git.219.0b5aff4.el7	RHBA-2019:0326
Red Hat OpenShift 3	openshift-enterprise-cluster-capacity	3.11.82-1.git.380.cf11c51.el7	RHBA-2019:0326
Red Hat OpenShift 3	prometheus +1	3.11.82-1.git.5027.9d24833.el7	RHBA-2019:0326
Red Hat OpenShift 3	prometheus-alertmanager +1	3.11.82-1.git.0.3bf41ce.el7	RHBA-2019:0326
Red Hat OpenShift 3	prometheus-node-exporter +1	3.11.82-1.git.1063.48444e8.el7	RHBA-2019:0326

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.jenkins-ci.main:jenkins-core	< 2.159	2.159	GHSA-8qxp-g8jv-p37x

Advisories 1

RHBA-2019:0326 Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix update Red Hat Security Advisories (RHSA) · Aug 5, 2026

References

https://jenkins.io/security/advisory/2019-01-16/#SECURITY-901
106680 vdb-entry
RHBA-2019:0327 vendor-advisory