Bug 1446122 (CVE-2017-1000354)

Summary: CVE-2017-1000354 jenkins: Login command allowed impersonating any Jenkins user (SECURITY-466)
Product: [Other] Security Response Reporter: Adam Mariš <amaris>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abhgupta, bleanhar, ccoleman, dedgar, dmcphers, java-sig-commits, jgoulding, joelsmith, mizdebsk, msrb, ngaywood, tdawson, tiwillia
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: jenkins 2.46.2, jenkins 2.57 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-10-21 11:53:39 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1446133, 1446134    
Bug Blocks: 1395176, 1446135    

Description Adam Mariš 2017-04-27 09:55:13 UTC 
The login command available in the remoting-based CLI stored the encrypted user name of the successfully authenticated user in a cache file used to authenticate further commands. Users with sufficient permission to create secrets in Jenkins, and download their encrypted values (e.g. with Job/Configure permission), were able to impersonate any other Jenkins user on the same instance.

This has been fixed by storing the cached authentication as a hash-based MAC with a key specific to the Jenkins instance and the CLI authentication cache.

Previously cached authentications are invalidated when upgrading Jenkins to a version containing a fix for this.

Affected versions:

    All Jenkins main line releases up to and including 2.56
    All Jenkins LTS releases up to and including 2.46.1

Fixed in:

    Jenkins main line users should update to 2.57
    Jenkins LTS users should update to 2.46.2

External Reference:

https://jenkins.io/security/advisory/2017-04-26/#cli-login-command-allowed-impersonating-any-jenkins-user
Comment 1 Adam Mariš 2017-04-27 09:55:35 UTC 
Acknowledgments:

Name: the Jenkins project
Upstream: Jesse Glick (CloudBees)
Comment 2 Adam Mariš 2017-04-27 10:08:31 UTC 
Created jenkins tracking bugs for this issue:

Affects: fedora-all [bug 1446133]
Affects: openshift-1 [bug 1446134]