PT-2021-14725 · Jenkins · Jenkins

Daniel Beck + 2 · Published 2021-10-06 · Updated 2024-03-06 · CVE-2021-21682

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.314 and earlier Jenkins LTS versions 2.303.1 and earlier

Description The issue arises from Jenkins accepting names of jobs and other entities with a trailing dot character on Windows, potentially allowing users with appropriate permissions to change or replace configurations of jobs and other entities. This is because on Windows, a file or folder with a trailing dot character is treated as if that character was not present. For example, example. is treated as example. This could lead to unintended replacement of configuration and data of other entities.

Recommendations For Jenkins versions 2.314 and earlier, update to version 2.315 or later to resolve the issue. For Jenkins LTS versions 2.303.1 and earlier, update to version 2.303.2 or later to resolve the issue. As a temporary workaround, consider restricting the creation of jobs and other entities with names that could potentially conflict with existing ones, especially those with trailing dot characters.

Fix

Weakness Enumeration

CWE-42

Related Identifiers

BIT-JENKINS-2021-21682

CVE-2021-21682

GHSA-6Q4G-84F3-MW74

Affected Products

Jenkins

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2021-21682 · Security Note
• https://jenkins.io/security/advisory/2021-10-06/#SECURITY-2424 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21682 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6q4g-84f3-mw74 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jenkins-2021-21682 · Vendor Advisory
• https://github.com/jenkinsci/jenkins/commit/c2c2b59071265aea07f88d5e95297c0a433921c3 · Note
• https://t.me/cvenotify/22042 · Telegram Post
• http://openwall.com/lists/oss-security/2021/10/06/1 · Note