PT-2020-15305 · Cloudbees+1 · Jenkins

Thijs Alkemade · Published 2020-01-29 · Updated 2024-03-06 · CVE-2020-2099

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.213 and earlier Jenkins LTS versions 2.204.1 and earlier

Description The issue arises from the improper reuse of encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents. This can be used to connect to Jenkins, impersonating those agents. The protocol was deprecated in 2018 and removed from Jenkins in version 2.214. However, it could still be enabled in older versions.

Recommendations For Jenkins versions 2.213 and earlier, update to version 2.214 or later to completely remove the vulnerable Inbound TCP Agent Protocol/3. For Jenkins LTS versions 2.204.1 and earlier, update to version 2.204.2 or later, and avoid setting the system property jenkins.slaves.JnlpSlaveAgentProtocol3.ALLOW UNSAFE to true, as this would re-enable the vulnerable protocol.

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-323

CWE-330

Related Identifiers

BIT-JENKINS-2020-2099

CVE-2020-2099

GHSA-QP4F-2W67-C8HW

Affected Products

Jenkins

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2020-2099 · Security Note
• https://access.redhat.com/errata/RHSA-2020:0683 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jenkins-2020-2099 · Vendor Advisory
• https://access.redhat.com/errata/RHBA-2020:0675 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2020:0681 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qp4f-2w67-c8hw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2099 · Vendor Advisory
• https://access.redhat.com/errata/RHBA-2020:0402 · Vendor Advisory
• https://jenkins.io/security/advisory/2020-01-29/#SECURITY-1682 · Vendor Advisory
• https://github.com/jenkinsci/jenkins · Note
• https://github.com/jenkinsci/jenkins/commit/5054bc6e12e1022993d719f66e289ab1d22ae854 · Note
• https://t.me/cvenotify/594 · Telegram Post
• http://openwall.com/lists/oss-security/2020/01/29/1 · Note