PT-2018-7138 · Jenkins · Jenkins

Published 2018-05-15 · Updated 2022-05-13 · CVE-2017-2612

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Jenkins versions prior to 2.44 Jenkins versions prior to 2.32.2

Description: The issue allows low privilege users to override JDK download credentials, which may cause future builds to fail when downloading a JDK.

Recommendations: For versions prior to 2.44, update to version 2.44 or later. For versions prior to 2.32.2, update to version 2.32.2 or later.

Fix

Improperly Implemented Security Check for Standard

Incorrect Permission

Weakness Enumeration

CWE-358

CWE-732

Related Identifiers

CVE-2017-2612

GHSA-WF9G-RH76-6JVR

Affected Products

Jenkins

References · 8

• https://github.com/jenkinsci/jenkins/commit/a814154695e23dc37542af7d40cacc129cf70722 · Patch
• https://osv.dev/vulnerability/CVE-2017-2612 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-2612 · Security Note
• https://jenkins.io/security/advisory/2017-02-01 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wf9g-rh76-6jvr · Vendor Advisory
• https://github.com/jenkinsci/jenkins · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2612 · Note
• http://securityfocus.com/bid/95957 · Note