PT-2017-10952 · Cloudbees+1 · Jenkins

Steve Marlowe · Publicado 2017-07-13 · Atualizado 2022-05-17 · CVE-2017-1000362

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 1.498

Description A security issue was found where the re-key admin monitor in Jenkins created a backup directory with old secrets and the key used to encrypt them. This directory was world-readable and not removed after the re-encryption process. The issue affects Jenkins instances where the re-key admin monitor was introduced, potentially exposing sensitive information.

Recommendations For versions prior to 1.498, check for the directory $JENKINS HOME/jenkins.security.RekeySecretAdminMonitor/backups and delete it if present to prevent unauthorized access to sensitive information. Upgrading to version 1.498 or later will prevent the creation of the backup directory.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-1000362

GHSA-92MR-4W2Q-4578

Produtos afetados

Jenkins

Referências · 7

• https://github.com/jenkinsci/jenkins · Nota
• https://github.com/jenkinsci/jenkins/commit/0be33cf7328fad6a7596ce9505a74561a8b1eb85 · Nota
• https://github.com/jenkinsci/jenkins/commit/a572450f039fdb99410fcf6eb0ba307bd69ea458 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000362 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-92mr-4w2q-4578 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-1000362 · Aviso do Fabricante
• https://jenkins.io/security/advisory/2017-02-01 · Aviso do Fabricante