Jenkins < 2.204.2 LTS / 2.219 Multiple Vulnerabilities

Medium Nessus Plugin ID 133527

Synopsis

A job scheduling and management system hosted on the remote web server is affected by multiple vulnerabilities.

Description

The version of Jenkins running on the remote web server is prior to 2.219 or is a version of Jenkins LTS prior to 2.204.2. It is, therefore, affected by multiple vulnerabilities:

- An UDP amplification reflection attack can be used in a DDoS attack on a Jenkins master. Within the same network, spoofed UDP packets could also be sent to make two Jenkins masters go into an infinite loop of replies to one another, thus causing a denial of service.
(CVE-2020-2100)

- A non-constant time comparison of inbound TCP agent connection secret is used when an inbound TCP agent connection is initiated. This allows attackers to use statistical methods to obtain the connection secret.
(CVE-2020-2101)

- A non-constant time HMAC comparison is used when checking whether two HMACs are equal. This could potentially allow attackers to use statistical methods to obtain a valid HMAC for an attacker-controlled input value. (CVE-2020-2102)

- User metadata on the /whoAmI page includes the HTTP session ID which allows attackers able to exploit a cross-site scripting vulnerability to obtain the HTTP session ID value. (CVE-2020-2103)

- A lack of appropriate permissions allows anyone with Overall/Read permissions to access the JVM memory usage chart for the Jenkins master.
(CVE-2020-2104)

- The Jenkins REST APIs allows an attacker to perform a clickjacking attack by routing them to a specially crafted web page, and can expose the content of the REST API endpoint. (CVE-2020-2105)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade Jenkins to version 2.219 or later, Jenkins LTS to version 2.204.2 or later.

See Also

https://jenkins.io/security/advisory/2020-01-29/

Plugin Details

Severity: Medium

ID: 133527

File Name: jenkins_security_advisory_2020-01-29.nasl

Version: 1.3

Type: remote

Family: CGI abuses

Published: 2020/02/06

Updated: 2020/04/03

Dependencies: 65054

Risk Information

Risk Factor: Medium

CVSS Score Source: CVE-2020-2105

CVSS v2.0

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

CVSS v3.0

Base Score: 5.4

Temporal Score: 4.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:cloudbees:jenkins

Required KB Items: www/Jenkins

Exploit Ease: No known exploits are available

Patch Publication Date: 2020/01/29

Vulnerability Publication Date: 2020/01/29

Reference Information

CVE: CVE-2020-2100, CVE-2020-2101, CVE-2020-2102, CVE-2020-2103, CVE-2020-2104, CVE-2020-2105, CVE-2020-2106