PT-2021-14648 · Jenkins · Jenkins

Wadeck Follonier · Published 2021-01-13 · Updated 2024-03-06 · CVE-2021-21605

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.274 and earlier, LTS versions 2.263.1 and earlier

Description The issue allows users with Agent/Configure permission to choose agent names that cause Jenkins to override the global config.xml file. If the global config.xml file is replaced, Jenkins will start up with unsafe legacy defaults after a restart. This can be exploited by choosing specific agent names.

Recommendations For versions 2.274 and earlier, LTS 2.263.1 and earlier, update to Jenkins 2.275, LTS 2.263.2 to ensure that agent names are considered valid names for items to prevent this problem. As a temporary workaround, consider setting the Java system property jenkins.model.Nodes.enforceNameRestrictions to true to enforce name restrictions. Note that this change can be reverted by setting the Java system property jenkins.model.Nodes.enforceNameRestrictions to false if problems occur.

Fix

Path traversal

RCE

Weakness Enumeration

CWE-22

CWE-20

Related Identifiers

BIT-JENKINS-2021-21605

CVE-2021-21605

GHSA-PXGQ-GQR9-5GWX

RHSA-2021:0423

RHSA-2021:0429

RHSA-2021:0637

Affected Products

Jenkins

References · 9

• https://osv.dev/vulnerability/GHSA-pxgq-gqr9-5gwx · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jenkins-2021-21605 · Vendor Advisory
• https://jenkins.io/security/advisory/2021-01-13/#SECURITY-2021 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21605 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21605 · Vendor Advisory
• https://github.com/jenkinsci/jenkins · Note
• https://github.com/jenkinsci/jenkins/commit/b19b34db4b24b163d4edc53ccb84f41a3589cb08 · Note
• https://t.me/cvenotify/8674 · Telegram Post
• https://t.me/cibsecurity/22091 · Telegram Post