Skip to content
OpenAdvisories
High · 8.0 CVE-2021-21604 BIT-jenkins-2021-21604EUVD-2022-5032GHSA-qv6f-rcv6-6q3x

Improper handling of REST API XML deserialization errors in Jenkins

Published Jan 13, 2021 · Updated Aug 3, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Package: jenkins Package: org.jenkins-ci.main:jenkins-core Category: Web / CMS Ecosystem: Alpine Ecosystem: Maven

Description

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows attackers with permission to create or configure various objects to inject crafted content into Old Data Monitor that results in the instantiation of potentially unsafe objects once discarded by an administrator.

Affected products

VendorProductAffectedFixed
Jenkins project Jenkins unspecified – ≤ 2.274, unspecified – ≤ LTS 2.263.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat OpenShift 4 afterburn +1 5.0.0-1.rhaos4.8.el8 RHSA-2021:2437
Red Hat OpenShift 4 atomic-openshift-service-idler 4.8.0-202106281541.p0.git.39cfc66.assembly.stream.el8 RHSA-2021:2437
Red Hat OpenShift 4 butane 0.12.1-1.rhaos4.8.el8 RHSA-2021:2437
Red Hat OpenShift 4 conmon 2:2.0.21-1.rhaos4.5.el7 RHSA-2021:0429
Red Hat OpenShift 4 console-login-helper-messages +2 0.20.3-1.rhaos4.8.el8 RHSA-2021:2437
Red Hat OpenShift 4 coreos-installer +1 0.9.0-6.rhaos4.8.el8 RHSA-2021:2437
Red Hat OpenShift 4 cri-o 1.21.2-5.rhaos4.8.gitb27d974.el7 RHSA-2021:2437
Red Hat OpenShift 4 cri-tools 1.21.0-2.el7 RHSA-2021:2437
Red Hat OpenShift 4 haproxy 2.2.13-1.el7 RHSA-2021:2437
Red Hat OpenShift 4 ignition +1 2.9.0-6.rhaos4.8.el8 RHSA-2021:2437
Red Hat OpenShift 4 ironic-images +3 2021.1-20210614.1.el8 RHSA-2021:2437
Red Hat OpenShift 4 jenkins 2.263.3.1612434332-1.el7 RHSA-2021:2437, RHSA-2021:0429, RHSA-2021:0423
Red Hat OpenShift 4 jenkins-2-plugins 4.8.1624022417-1.el8 RHSA-2021:2437
Red Hat OpenShift 4 kata-containers 2.1.0-4.el8 RHSA-2021:2437
Red Hat OpenShift 4 machine-config-daemon 4.5.0-202102050524.p0.git.2594.ff3b8c0.el8 RHSA-2021:0429
Red Hat OpenShift 4 openshift +1 4.5.0-202102050524.p0.git.0.9229406.el7 RHSA-2021:2437, RHSA-2021:0429
Red Hat OpenShift 4 openshift-ansible +1 4.5.0-202102031005.p0.git.0.c6839a2.el7 RHSA-2021:2437, RHSA-2021:0429
Red Hat OpenShift 4 openshift-clients +1 4.5.0-202102051529.p0.git.3612.61b096a.el7 RHSA-2021:2437, RHSA-2021:0429
Red Hat OpenShift 4 openshift-kuryr +4 4.8.0-202106281541.p0.git.8a4c2d8.assembly.stream.el8 RHSA-2021:2437
Red Hat OpenShift 4 openstack-ironic +4 1:17.0.4-0.20210713221218.a415e7e.el8 RHSA-2021:2437
Red Hat OpenShift 4 openstack-ironic-inspector +4 10.6.1-0.20210406091336.579f59c.el8 RHSA-2021:2437
Red Hat OpenShift 4 openvswitch2.15 +3 2.15.0-9.el8fdp RHSA-2021:2437
Red Hat OpenShift 4 ostree +3 2020.7-5.el8_4 RHSA-2021:2437
Red Hat OpenShift 4 ovn2.13 +3 20.12.0-25.el8fdp RHSA-2021:2437
Red Hat OpenShift 4 podman +3 3.0.1-6.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-debtcollector +1 2.2.0-0.20210324220630.649189d.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-eventlet +1 0.25.2-4.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-hardware +2 0.27.0-0.20210406121246.756fedb.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-ironic-lib +1 4.6.2-0.20210608101214.ca2e4ba.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-ironic-prometheus-exporter +1 2.2.1-0.20210325143713.70e39c8.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-jsonschema +1 3.2.0-5.el8ost RHSA-2021:2437
Red Hat OpenShift 4 python-keystoneauth1 +1 4.3.0-0.20210325001456.6a66271.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-kubernetes +2 12.0.1-1.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-openshift +1 1:0.12.1-1.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-openstacksdk +2 0.53.0-0.20210325011601.4629245.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-concurrency +3 4.4.0-0.20210325004915.7dcf9e9.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-config +1 2:8.5.0-0.20210325050501.cfa2564.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-context +1 3.2.0-0.20210325043103.0d02866.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-db +3 8.5.0-0.20210325041241.503db60.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-i18n +2 5.0.1-0.20210324221600.73187bd.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-log +3 4.4.0-0.20210409081224.9b29c90.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-policy +2 3.7.0-0.20210325051823.d853485.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-serialization +2 4.1.0-0.20210325012242.8445e61.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-service +2 2.5.0-0.20210325014731.d25e454.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-upgradecheck +1 1.3.0-0.20210325003851.9f95a6e.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-utils +3 4.8.0-0.20210325043201.3288539.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-pyrsistent +1 0.16.0-3.el8ost RHSA-2021:2437
Red Hat OpenShift 4 python-stevedore +1 3.3.0-0.20210325001012.7d7154f.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-sushy +2 3.7.1-0.20210428165244.bc49878.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-sushy-oem-idrac +2 2.0.1-0.20210326152858.83b7eb0.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-tooz +1 2.8.0-0.20210324235001.54448e9.el8 RHSA-2021:2437
Red Hat OpenShift 4 python3-ironic-python-agent +1 7.0.2-0.20210611153100.bfa97cb.el8 RHSA-2021:2437
Red Hat OpenShift 4 redhat-release-coreos 48.84-4.el8 RHSA-2021:2437
Red Hat OpenShift 4 rteval-loads 1.4-12.el8 RHSA-2021:2437
Red Hat OpenShift 4 runc 1.0.0-72.rhaos4.5.giteadfc6b.el8 RHSA-2021:2437, RHSA-2021:0429
Red Hat OpenShift 4 stress-ng 0.12.06-1.el8 RHSA-2021:2437
Red Hat OpenShift 4 toolbox 0.0.8-3.rhaos4.8.el8 RHSA-2021:2437
Red Hat OpenShift 3 jenkins 2.263.3.1612433584-1.el7 RHSA-2021:0637
Red Hat OpenShift 3 jenkins-2-plugins 3.11.1612862361-1.el7 RHSA-2021:0637
Red Hat OpenShift 3 python-rsa +1 4.5-3.el7 RHSA-2021:0637

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 jenkins 2.275-r0 —
Alpine v3.23 jenkins 2.275-r0 —
Alpine v3.22 jenkins 2.275-r0 —
Alpine v3.21 jenkins 2.275-r0 —
Alpine v3.20 jenkins 2.275-r0 —
Show 8 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 jenkins 2.275-r0 —
Alpine v3.18 jenkins 2.275-r0 —
Alpine v3.17 jenkins 2.275-r0 —
Alpine v3.16 jenkins 2.275-r0 —
Alpine v3.15 jenkins 2.275-r0 —
Alpine v3.14 jenkins 2.275-r0 —
Alpine v3.13 jenkins 2.275-r0 —
Alpine v3.12 jenkins 2.275-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.main:jenkins-core < 2.263.2 2.263.2 GHSA-qv6f-rcv6-6q3x
Maven org.jenkins-ci.main:jenkins-core >= 2.264, < 2.275 2.275 GHSA-qv6f-rcv6-6q3x

Advisories 4

References