[oss-security] 20210318 Multiple vulnerabilities in Jenkins plugins

https://www.jenkins.io/security/advisory/2021-03-18/#SECURITY-2180

The version of Jenkins Enterprise or Jenkins Operations Center running on the remote web server is 2.222.x prior to 2.222.43.0.3 rev2, 2.249.x prior to 2.249.30.0.3 rev2, or 2.x prior to 2.277.1.2 rev2. It is, therefore, affected by multiple vulnerabilities, including the following:

  - An incorrect permission check in Jenkins Matrix Authorization Strategy Plugin 2.6.5 and earlier allows     attackers with Item/Read permission on nested items to access them, even if they lack Item/Read permission     for parent folders. (CVE-2021-21623)

  - An incorrect permission check in Jenkins Role-based Authorization Strategy Plugin 3.1 and earlier allows     attackers with Item/Read permission on nested items to access them, even if they lack Item/Read permission     for parent folders. (CVE-2021-21624)

  - A cross-site request forgery (CSRF) vulnerability in Jenkins Libvirt Agents Plugin 1.9.0 and earlier     allows attackers to stop hypervisor domains. (CVE-2021-21627)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2437 advisory.

  - python-eventlet: improper handling of highly compressed data and memory allocation with excessive size     allows DoS (CVE-2021-21419)

  - jenkins-2-plugins/matrix-auth: Incorrect permission checks in Matrix Authorization Strategy Plugin     (CVE-2021-21623)

  - jenkins: lack of type validation in agent related REST API (CVE-2021-21639)

  - jenkins: view name validation bypass (CVE-2021-21640)

  - jenkins-2-plugins/credentials: Reflected XSS vulnerability in Credentials Plugin (CVE-2021-21648)

  - kubernetes: Validating Admission Webhook does not observe some previous fields (CVE-2021-25735)

  - kubernetes: Holes in EndpointSlice Validation Enable Host Network Hijack (CVE-2021-25737)

  - golang: crypto/elliptic: incorrect operations on the P-224 curve (CVE-2021-3114)

  - gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation (CVE-2021-3121)

  - openshift: Injected service-ca.crt incorrectly contains additional internal CAs (CVE-2021-3636)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
155633	Jenkins Enterprise and Operations Center < 2.222.43.0.3 rev2 / 2.249.30.0.3 rev2 / 2.277.1.2 rev2 Multiple Vulnerabilities (CloudBees Security Advisory 2021-03-18)	Nessus	CGI abuses	high
152103	RHEL 7 / 8 : OpenShift Container Platform 4.8.2 packages and (RHSA-2021:2437)	Nessus	Red Hat Local Security Checks	high

CVE-2021-21623

medium

New! CVE Severity Now Using CVSS v3

Description

References

Details

Risk Information

CVSS v2

CVSS v3

Vulnerable Software

Configuration 1

Tenable Plugins

high

high