Bug 1797068 (CVE-2020-2105)

Summary: CVE-2020-2105 jenkins: REST APIs vulnerable to clickjacking
Product: [Other] Security Response Reporter: Pedro Sampaio <psampaio>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: abenaiss, adam.kaplan, aos-bugs, bmontgom, eparis, extras-orphan, java-sig-commits, jburrell, jokerman, mizdebsk, msrb, nstielau, pbhattac, sponnaga, wzheng
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: jenkins 2.219, jenkins LTS 2.204.2 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-10-28 01:16:11 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1797069, 1797143, 1797144, 1797146, 1813070, 1873172    
Bug Blocks: 1797089    

Description Pedro Sampaio 2020-01-31 20:19:44 UTC
REST API endpoints in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier were vulnerable to clickjacking attacks. 

References:

https://jenkins.io/security/advisory/2020-01-29/#SECURITY-1704
http://www.openwall.com/lists/oss-security/2020/01/29/1

Comment 1 Pedro Sampaio 2020-01-31 20:20:11 UTC
Created jenkins tracking bugs for this issue:

Affects: fedora-all [bug 1797069]

Comment 4 Sam Fowler 2020-02-01 01:58:09 UTC
"Any security advisory related updates to Jenkins core or the plugins we include in the OpenShift Jenkins master image will only occur in the v3.11 and v4.x branches of this repository."

https://github.com/openshift/jenkins/blob/master/README.md#jenkins-security-advisories-the-master-image-from-this-repository-and-the-oc-binary

Comment 5 Akram Ben Aissi 2020-03-03 09:07:36 UTC
This bug has been fixed by https://errata.devel.redhat.com/advisory/50532 that brought Jenkins 2.204.2