Bug 1699701 (CVE-2019-1003049)

Summary:	CVE-2019-1003049 jenkins: Jenkins accepted cached legacy CLI authentication
Product:	[Other] Security Response	Reporter:	Sam Fowler <sfowler>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abenaiss, adam.kaplan, ahardin, aos-bugs, bleanhar, bmontgom, ccoleman, dedgar, eparis, java-sig-commits, jburrell, jgoulding, jokerman, mchappel, mizdebsk, mmccomas, msrb, nstielau, obulatov, pbhattac, sponnaga, wzheng
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	jenkins 2.172, jenkins 2.164.2	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-27 03:27:47 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1699702, 1699706, 1699707
Bug Blocks:	1699336

Description Sam Fowler 2019-04-15 03:17:56 UTC

The fix for SECURITY-901/CVE-2019-1003004 in Jenkins 2.150.2 and 2.160 did not reject existing remoting-based CLI authentication caches.

This means that users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated.

Support for the remoting-based CLI was dropped in Jenkins 2.165, so newer weekly releases are not affected. Jenkins 2.164.2 no longer supports legacy CLI authentication caches from before 2.150.2/2.160, and these users will be considered logged out.


External References:

https://jenkins.io/security/advisory/2019-04-10/#SECURITY-1289

Comment 1 Sam Fowler 2019-04-15 03:18:26 UTC

Created jenkins tracking bugs for this issue:

Affects: fedora-all [bug 1699702]

Comment 4 Sam Fowler 2019-04-15 03:34:31 UTC

OpenShift Jenkins update policy[0]:

"Any security advisory related updates to Jenkins core or the plugins we include in the OpenShift Jenkins master image will only occur in the v3.11 and v4.x branches of this repository.

We do support running the v3.11 version of the master image against older v3.x (as far back as v3.4) OpenShift clusters if you want to pick up Jenkins security advisory updates."

[0] https://github.com/openshift/jenkins/blob/master/README.md#jenkins-security-advisories-the-master-image-from-this-repository-and-the-oc-binary

Comment 5 Sam Fowler 2019-07-03 01:43:20 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 3.11

Via RHBA-2019:1605 https://access.redhat.com/errata/RHBA-2019:1605