PT-2017-10952 · Cloudbees+1 · Jenkins

Steve Marlowe · Published 2017-07-13 · Updated 2022-05-17 · CVE-2017-1000362

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 1.498

Description A security issue was found where the re-key admin monitor in Jenkins created a backup directory with old secrets and the key used to encrypt them. This directory was world-readable and not removed after the re-encryption process. The issue affects Jenkins instances where the re-key admin monitor was introduced, potentially exposing sensitive information.

Recommendations For versions prior to 1.498, check for the directory $JENKINS HOME/jenkins.security.RekeySecretAdminMonitor/backups and delete it if present to prevent unauthorized access to sensitive information. Upgrading to version 1.498 or later will prevent the creation of the backup directory.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-1000362

GHSA-92MR-4W2Q-4578

Affected Products

Jenkins

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2017-1000362 · Security Note
• https://osv.dev/vulnerability/GHSA-92mr-4w2q-4578 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-1000362 · Vendor Advisory
• https://jenkins.io/security/advisory/2017-02-01 · Vendor Advisory
• https://github.com/jenkinsci/jenkins · Note
• https://github.com/jenkinsci/jenkins/commit/0be33cf7328fad6a7596ce9505a74561a8b1eb85 · Note
• https://github.com/jenkinsci/jenkins/commit/a572450f039fdb99410fcf6eb0ba307bd69ea458 · Note