PT-2018-7138 · Jenkins · Jenkins

Publicado 2018-05-15 · Atualizado 2022-05-13 · CVE-2017-2612

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Jenkins versions prior to 2.44 Jenkins versions prior to 2.32.2

Description: The issue allows low privilege users to override JDK download credentials, which may cause future builds to fail when downloading a JDK.

Recommendations: For versions prior to 2.44, update to version 2.44 or later. For versions prior to 2.32.2, update to version 2.32.2 or later.

Correção

Improperly Implemented Security Check for Standard

Incorrect Permission

Enumeração de Fraquezas

CWE-358

CWE-732

Identificadores relacionados

CVE-2017-2612

GHSA-WF9G-RH76-6JVR

Produtos afetados

Jenkins

Referências · 8

• https://github.com/jenkinsci/jenkins · Nota
• https://github.com/jenkinsci/jenkins/commit/a814154695e23dc37542af7d40cacc129cf70722 · Correção
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2612 · Nota
• https://osv.dev/vulnerability/CVE-2017-2612 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-2612 · Nota de Segurança
• https://jenkins.io/security/advisory/2017-02-01 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-wf9g-rh76-6jvr · Aviso do Fabricante
• http://securityfocus.com/bid/95957 · Nota