Bug 1925157 (CVE-2021-21604)

Summary:	CVE-2021-21604 jenkins: Improper handling of REST API XML deserialization errors
Product:	[Other] Security Response	Reporter:	Michael Kaplan <mkaplan>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	abenaiss, aileenc, aos-bugs, bmontgom, chazlett, dramseur, drieden, eparis, ggaughan, gmalinko, janstey, jburrell, jhunter, jochrist, jokerman, jwon, kmitts, mgala, mjudeiki, nstielau, pbhattac, sponnaga, vbobade
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	jenkins 2.275, jenkins LTS 2.263.2	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in jenkins. An attacker with permission to create or configure various objects to inject crafted content into Old Data Monitor can cause the instantiation of potentially unsafe objects once discarded by an administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-02-18 19:02:40 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1925482, 1925483, 1925484, 1925485, 1925486, 1929919, 1929921
Bug Blocks:	1925147

Description Michael Kaplan 2021-02-04 13:56:57 UTC

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows attackers with permission to create or configure various objects to inject crafted content into Old Data Monitor that results in the instantiation of potentially unsafe objects once discarded by an administrator.

Comment 3 errata-xmlrpc 2021-02-17 19:05:03 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.6

Via RHSA-2021:0423 https://access.redhat.com/errata/RHSA-2021:0423

Comment 4 Product Security DevOps Team 2021-02-18 19:02:40 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-21604

Comment 5 errata-xmlrpc 2021-03-03 04:17:57 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.5

Via RHSA-2021:0429 https://access.redhat.com/errata/RHSA-2021:0429