PT-2015-3731 · Cloudbees+1 · Jenkins

Kohsuke + 1 · Publicado 2015-11-25 · Atualizado 2023-02-13 · CVE-2014-3665

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 1.587 Jenkins LTS versions prior to 1.580.1

Description The issue is related to improper trust separation between a master and slaves, which might allow remote attackers to execute arbitrary code on the master by leveraging access to the slave.

Recommendations For Jenkins versions prior to 1.587, update to version 1.587 or later. For Jenkins LTS versions prior to 1.580.1, update to version 1.580.1 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2014-3665

GHSA-66CR-6WHX-732P

Produtos afetados

Jenkins

Referências · 9

• https://cloudbees.com/jenkins-security-advisory-2014-10-30 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-66cr-6whx-732p · Aviso do Fabricante
• https://wiki.jenkins-ci.org/display/JENKINS/Slave+To+Master+Access+Control · Aviso do Fabricante
• https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-30 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3665 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-3665 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=1147767 · Nota
• https://access.redhat.com/security/cve/CVE-2014-3665 · Nota
• https://access.redhat.com/errata/RHBA-2014:1630 · Nota