PT-2023-5390 · Jenkins+1 · Jenkins+1
Daniel Beck
·
Publicado
2023-09-19
·
Atualizado
2025-05-02
·
CVE-2023-43496
CVSS v3.1
8.8
Alta
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Jenkins versions 2.423 and earlier, LTS versions 2.414.1 and earlier
Description
The issue is related to the creation of a temporary file in the system temporary directory with default permissions when installing a plugin from a URL. This potentially allows attackers with access to the system temporary directory to replace the file before it is installed in Jenkins, resulting in arbitrary code execution. The vulnerability is particularly relevant on operating systems that use a shared temporary directory for all users, such as Linux. However, the default permissions for newly created files generally only allow attackers to read the temporary file, not write to it.
Recommendations
For Jenkins versions 2.423 and earlier, LTS versions 2.414.1 and earlier, update to Jenkins 2.424 or LTS 2.414.2, which creates the temporary file in a subdirectory with more restrictive permissions.
As a temporary workaround for those unable to immediately update Jenkins, consider changing the default temporary-file directory using the Java system property java.io.tmpdir to minimize the risk of exploitation.
Correção
Incorrect Default Permissions
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Jenkins
Red Os