Skip to content
OpenAdvisories
Medium · 4.3 CVE-2021-21645 EUVD-2022-1948GHSA-2959-fj73-hm8p

Missing permission checks in Jenkins Config File Provider Plugin allow enumerating configuration file IDs

Published Apr 21, 2021 · Updated Aug 3, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Config File Provider Plugin Package: org.jenkins-ci.plugins:config-file-provider Category: Web / CMS Ecosystem: Maven

Description

Jenkins Config File Provider Plugin 3.7.0 and earlier does not perform permission checks in several HTTP endpoints, attackers with Overall/Read permission to enumerate configuration file IDs.

Affected products

VendorProductAffectedFixed
Jenkins project Jenkins Config File Provider Plugin unspecified – ≤ 3.7.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat OpenShift 4 afterburn +1 5.0.0-1.rhaos4.8.el8 RHSA-2021:2437
Red Hat OpenShift 4 atomic-openshift-service-idler 4.8.0-202106281541.p0.git.39cfc66.assembly.stream.el8 RHSA-2021:2437
Red Hat OpenShift 4 butane 0.12.1-1.rhaos4.8.el8 RHSA-2021:2437
Red Hat OpenShift 4 console-login-helper-messages +2 0.20.3-1.rhaos4.8.el8 RHSA-2021:2437
Red Hat OpenShift 4 coreos-installer +1 0.9.0-6.rhaos4.8.el8 RHSA-2021:2437
Red Hat OpenShift 4 cri-o 1.20.2-12.rhaos4.7.git9f7be76.el7 RHSA-2021:2437, RHSA-2021:2122
Red Hat OpenShift 4 cri-tools 1.20.0-3.el7 RHSA-2021:2437, RHSA-2021:2122
Red Hat OpenShift 4 haproxy 2.2.13-1.el7 RHSA-2021:2437
Red Hat OpenShift 4 ignition +1 2.9.0-6.rhaos4.8.el8 RHSA-2021:2437
Red Hat OpenShift 4 ironic-images +3 2021.1-20210614.1.el8 RHSA-2021:2437
Red Hat OpenShift 4 jenkins 2.277.3.1623846768-1.el7 RHSA-2021:2437, RHSA-2021:2431
Red Hat OpenShift 4 jenkins-2-plugins 4.5.1623326336-1.el7 RHSA-2021:2437, RHSA-2021:2431, RHSA-2021:2122
Red Hat OpenShift 4 kata-containers 2.1.0-4.el8 RHSA-2021:2437
Red Hat OpenShift 4 openshift +1 4.8.0-202107161820.p0.git.051ac4f.assembly.stream.el7 RHSA-2021:2437
Red Hat OpenShift 4 openshift-ansible +1 4.8.0-202106281541.p0.git.626f7a3.assembly.stream.el7 RHSA-2021:2437
Red Hat OpenShift 4 openshift-clients +1 4.8.0-202106281541.p0.git.1077b05.assembly.stream.el7 RHSA-2021:2437
Red Hat OpenShift 4 openshift-kuryr +4 4.8.0-202106281541.p0.git.8a4c2d8.assembly.stream.el8 RHSA-2021:2437
Red Hat OpenShift 4 openstack-ironic +4 1:17.0.4-0.20210713221218.a415e7e.el8 RHSA-2021:2437
Red Hat OpenShift 4 openstack-ironic-inspector +4 10.6.1-0.20210406091336.579f59c.el8 RHSA-2021:2437
Red Hat OpenShift 4 openvswitch2.15 +3 2.15.0-9.el8fdp RHSA-2021:2437
Red Hat OpenShift 4 ostree +3 2020.7-5.el8_4 RHSA-2021:2437
Red Hat OpenShift 4 ovn2.13 +3 20.12.0-25.el8fdp RHSA-2021:2437
Red Hat OpenShift 4 podman +3 3.0.1-6.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-debtcollector +1 2.2.0-0.20210324220630.649189d.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-eventlet +1 0.25.2-4.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-hardware +2 0.27.0-0.20210406121246.756fedb.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-ironic-lib +1 4.6.2-0.20210608101214.ca2e4ba.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-ironic-prometheus-exporter +1 2.2.1-0.20210325143713.70e39c8.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-jsonschema +1 3.2.0-5.el8ost RHSA-2021:2437
Red Hat OpenShift 4 python-keystoneauth1 +1 4.3.0-0.20210325001456.6a66271.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-kubernetes +2 12.0.1-1.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-openshift +1 1:0.12.1-1.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-openstacksdk +2 0.53.0-0.20210325011601.4629245.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-concurrency +3 4.4.0-0.20210325004915.7dcf9e9.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-config +1 2:8.5.0-0.20210325050501.cfa2564.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-context +1 3.2.0-0.20210325043103.0d02866.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-db +3 8.5.0-0.20210325041241.503db60.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-i18n +2 5.0.1-0.20210324221600.73187bd.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-log +3 4.4.0-0.20210409081224.9b29c90.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-policy +2 3.7.0-0.20210325051823.d853485.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-serialization +2 4.1.0-0.20210325012242.8445e61.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-service +2 2.5.0-0.20210325014731.d25e454.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-upgradecheck +1 1.3.0-0.20210325003851.9f95a6e.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-oslo-utils +3 4.8.0-0.20210325043201.3288539.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-pyrsistent +1 0.16.0-3.el8ost RHSA-2021:2437
Red Hat OpenShift 4 python-stevedore +1 3.3.0-0.20210325001012.7d7154f.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-sushy +2 3.7.1-0.20210428165244.bc49878.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-sushy-oem-idrac +2 2.0.1-0.20210326152858.83b7eb0.el8 RHSA-2021:2437
Red Hat OpenShift 4 python-tooz +1 2.8.0-0.20210324235001.54448e9.el8 RHSA-2021:2437
Red Hat OpenShift 4 python3-ironic-python-agent +1 7.0.2-0.20210611153100.bfa97cb.el8 RHSA-2021:2437
Red Hat OpenShift 4 redhat-release-coreos 47.83-2.el8 RHSA-2021:2437, RHSA-2021:2122
Red Hat OpenShift 4 rteval-loads 1.4-12.el8 RHSA-2021:2437
Red Hat OpenShift 4 runc 1.0.0-98.rhaos4.8.gitcd80260.el7 RHSA-2021:2437
Red Hat OpenShift 4 stress-ng 0.12.06-1.el8 RHSA-2021:2437
Red Hat OpenShift 4 toolbox 0.0.8-3.rhaos4.8.el8 RHSA-2021:2437
Red Hat OpenShift 3 jenkins 2.289.1.1624365627-1.el7 RHSA-2021:2517
Red Hat OpenShift 3 jenkins-2-plugins 3.11.1624366838-1.el7 RHSA-2021:2517

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.plugins:config-file-provider < 3.7.1 3.7.1 GHSA-2959-fj73-hm8p

Advisories 5

References