PT-2018-7129 · Cloudbees+1 · Jenkins

Jesse Glick · Publicado 2018-05-15 · Atualizado 2022-05-13 · CVE-2017-2602

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Jenkins versions prior to 2.44 Jenkins versions prior to 2.32.2

Description: The issue is related to an improper blacklisting of the Pipeline metadata files in the agent-to-master security subsystem. This could allow metadata files to be written to by malicious agents.

Recommendations: For versions prior to 2.44, update to version 2.44 or later. For versions prior to 2.32.2, update to version 2.32.2 or later.

Correção

Incomplete List of Disallowed Inputs

Enumeração de Fraquezas

CWE-184

Identificadores relacionados

CVE-2017-2602

GHSA-FFGG-VPHH-V273

Produtos afetados

Jenkins

Referências · 8

• https://github.com/jenkinsci/jenkins · Nota
• https://github.com/jenkinsci/jenkins/commit/414ff7e30aba66bed18c4ee8a8660fb36fc8c655 · Correção
• http://securityfocus.com/bid/95952 · Nota
• https://osv.dev/vulnerability/CVE-2017-2602 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-2602 · Nota de Segurança
• https://jenkins.io/security/advisory/2017-02-01 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-ffgg-vphh-v273 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2602 · Nota