Bug 1925140 (CVE-2021-21608)

Summary: CVE-2021-21608 jenkins: Stored XSS vulnerability in button labels
Product: [Other] Security Response Reporter: Michael Kaplan <mkaplan>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: abenaiss, aileenc, aos-bugs, bmontgom, chazlett, dramseur, drieden, eparis, ggaughan, gmalinko, janstey, jburrell, jhunter, jochrist, jokerman, jwon, kmitts, mgala, mjudeiki, nstielau, pbhattac, sponnaga, vbobade
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: jenkins 2.275, jenkins LTS 2.263.2 Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in jenkins. A cross-site scripting (XSS) vulnerability, due to the button labels not being properly escaped, can allow an attacker to control button labels. The highest threat from this vulnerability is to data confidentiality and integrity.
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-02-18 19:02:19 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1925482, 1925483, 1925484, 1925485, 1925486, 1929919, 1929921    
Bug Blocks: 1925147    

Description Michael Kaplan 2021-02-04 13:42:02 UTC
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape button labels in the Jenkins UI, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to control button labels.

Comment 3 errata-xmlrpc 2021-02-17 19:04:42 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.6

Via RHSA-2021:0423 https://access.redhat.com/errata/RHSA-2021:0423

Comment 4 Product Security DevOps Team 2021-02-18 19:02:19 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-21608

Comment 5 errata-xmlrpc 2021-03-03 04:17:43 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.5

Via RHSA-2021:0429 https://access.redhat.com/errata/RHSA-2021:0429