PT-2018-5267 · Jenkins · Jenkins

Daniel Beck · Published 2018-01-24 · Updated 2022-05-14 · CVE-2017-1000503

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.81 through 2.94

Description A race condition during startup could result in the wrong order of execution of commands during initialization, potentially leading to failure in initializing the setup wizard on the first startup. This issue could cause multiple security-related settings not to be set to their usual strict default.

Recommendations For Jenkins versions 2.81 through 2.94, update to a version outside of this range to ensure proper initialization of security settings.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2017-1000503

GHSA-R5X3-2446-HRP7

Affected Products

Jenkins

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2017-1000503 · Security Note
• https://jenkins.io/security/advisory/2017-12-14 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-1000503 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r5x3-2446-hrp7 · Vendor Advisory
• https://github.com/jenkinsci/jenkins · Note
• https://github.com/jenkinsci/jenkins/commit/ccc374a7176d7704941fb494589790b7673efe2 · Note