Skip to content
OpenAdvisories
High · 8.1 CVE-2019-1003049 EUVD-2022-2908GHSA-742j-jcfr-23w3

Insufficient Session Expiration in Jenkins

Published Apr 10, 2019 · Updated Aug 5, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Package: jenkins Package: org.jenkins-ci.main:jenkins-core Category: Web / CMS Ecosystem: Alpine Ecosystem: Maven

Description

Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, because the fix for CVE-2019-1003004 in these releases did not reject existing remoting-based CLI authentication caches.

Affected products

VendorProductAffectedFixed
Jenkins project Jenkins 2.171 and earlier, LTS 2.164.1 and earlier —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat OpenShift 3 atomic-enterprise-service-catalog +1 1:3.11.117-1.git.1.376e432.el7 RHBA-2019:1605
Red Hat OpenShift 3 atomic-openshift-cluster-autoscaler 3.11.117-1.git.1.caa79fa.el7 RHBA-2019:1605
Red Hat OpenShift 3 atomic-openshift-descheduler 3.11.117-1.git.1.1635b0a.el7 RHBA-2019:1605
Red Hat OpenShift 3 atomic-openshift-dockerregistry 3.11.117-1.git.1.6a42b08.el7 RHBA-2019:1605
Red Hat OpenShift 3 atomic-openshift-metrics-server 3.11.117-1.git.1.319d58e.el7 RHBA-2019:1605
Red Hat OpenShift 3 atomic-openshift-node-problem-detector 3.11.117-1.git.1.0345fe3.el7 RHBA-2019:1605
Red Hat OpenShift 3 atomic-openshift-service-idler 3.11.117-1.git.1.887bb82.el7 RHBA-2019:1605
Red Hat OpenShift 3 atomic-openshift-web-console 3.11.117-1.git.1.be7a05c.el7 RHBA-2019:1605
Red Hat OpenShift 3 cri-o 1.11.14-1.rhaos3.11.gitd56660e.el7 RHBA-2019:1605
Red Hat OpenShift 3 golang-github-openshift-oauth-proxy 3.11.117-1.git.1.2b006d2.el7 RHBA-2019:1605
Red Hat OpenShift 3 jenkins 2.164.2.1555422716-1.el7 RHBA-2019:1605
Red Hat OpenShift 3 jenkins-2-plugins 3.11.1559667994-1.el7 RHBA-2019:1605
Red Hat OpenShift 3 openshift-ansible +4 3.11.123-1.git.0.db681ba.el7 RHBA-2019:1605
Red Hat OpenShift 3 openshift-enterprise-autoheal 3.11.117-1.git.1.ef32a58.el7 RHBA-2019:1605
Red Hat OpenShift 3 openshift-enterprise-cluster-capacity 3.11.117-1.git.1.6593fce.el7 RHBA-2019:1605
Red Hat OpenShift 3 prometheus +1 3.11.117-1.git.1.f52d417.el7 RHBA-2019:1605
Red Hat OpenShift 3 prometheus-alertmanager +1 3.11.117-1.git.1.207ef35.el7 RHBA-2019:1605
Red Hat OpenShift 3 prometheus-node-exporter +1 3.11.117-1.git.1.dcee33f.el7 RHBA-2019:1605

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.9 jenkins 2.164.2-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.main:jenkins-core < 2.164.2 2.164.2 GHSA-742j-jcfr-23w3
Maven org.jenkins-ci.main:jenkins-core >= 2.165, < 2.172 2.172 GHSA-742j-jcfr-23w3

Advisories 1

References