Detections
Analytics

Jenkins < 2.204.2 LTS / 2.219 Multiple Vulnerabilities

medium Nessus Plugin ID 133527

Language:

Synopsis

A job scheduling and management system hosted on the remote web server is affected by multiple vulnerabilities.

Description

The version of Jenkins running on the remote web server is prior to 2.219 or is a version of Jenkins LTS prior to 2.204.2. It is, therefore, affected by multiple vulnerabilities:

 - An UDP amplification reflection attack can be used in a DDoS attack on a Jenkins master. Within the same network, spoofed UDP packets could also be sent to make two Jenkins masters go into an infinite loop of replies to one another, thus causing a denial of service.
 (CVE-2020-2100)

 - A non-constant time comparison of inbound TCP agent connection secret is used when an inbound TCP agent connection is initiated. This allows attackers to use statistical methods to obtain the connection secret.
 (CVE-2020-2101)

 - A non-constant time HMAC comparison is used when checking whether two HMACs are equal. This could potentially allow attackers to use statistical methods to obtain a valid HMAC for an attacker-controlled input value. (CVE-2020-2102)

 - User metadata on the /whoAmI page includes the HTTP session ID which allows attackers able to exploit a cross-site scripting vulnerability to obtain the HTTP session ID value. (CVE-2020-2103)

 - A lack of appropriate permissions allows anyone with Overall/Read permissions to access the JVM memory usage chart for the Jenkins master.
 (CVE-2020-2104)

 - The Jenkins REST APIs allows an attacker to perform a clickjacking attack by routing them to a specially crafted web page, and can expose the content of the REST API endpoint. (CVE-2020-2105)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade Jenkins to version 2.219 or later, Jenkins LTS to version 2.204.2 or later.

See Also

https://jenkins.io/security/advisory/2020-01-29/

Plugin Details

Severity: Medium

ID: 133527

File Name: jenkins_security_advisory_2020-01-29.nasl

Version: 1.6

Type: combined

Agent: windows, macosx, unix

Family: CGI abuses

Published: 2/6/2020

Updated: 5/18/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2020-2105

CVSS v3

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2020-2106

Vulnerability Information

CPE: cpe:/a:cloudbees:jenkins

Required KB Items: installed_sw/Jenkins

Exploit Ease: No known exploits are available

Patch Publication Date: 1/29/2020

Vulnerability Publication Date: 1/29/2020

Reference Information

CVE: CVE-2020-2100, CVE-2020-2101, CVE-2020-2102, CVE-2020-2103, CVE-2020-2104, CVE-2020-2105, CVE-2020-2106