Bug 2020385 (CVE-2021-21698)

Summary:	CVE-2021-21698 jenkins-2-plugins/subversion: does not restrict the name of a file when looking up a subversion key
Product:	[Other] Security Response	Reporter:	Michael Kaplan <mkaplan>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abenaiss, adam.kaplan, aos-bugs, bmontgom, eparis, jburrell, jokerman, nstielau, pbhattac, proguski, spandura, sponnaga, vkumar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	Subversion Plugin 2.15.1	Doc Type:	If docs needed, set a value
Doc Text:	An incorrect access restriction vulnerability was found in the Subversion Plugin for Jenkins. An agent's ability to learn the name of a file is not restricted when looking up a subversion key file on the controller. This may allow attackers to control agent processes and read arbitrary files on the Jenkins controller file system.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-12-02 23:11:06 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2020610, 2023248, 2023249, 2024998, 2024999, 2025000
Bug Blocks:	2020347

Description Michael Kaplan 2021-11-04 17:40:58 UTC

Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent.

This allows attackers able to control agent processes to read arbitrary files on the Jenkins controller file system

Reference:

https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2506

Comment 8 errata-xmlrpc 2021-11-29 10:37:27 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.9

Via RHSA-2021:4833 https://access.redhat.com/errata/RHSA-2021:4833

Comment 9 errata-xmlrpc 2021-11-30 09:09:34 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.8

Via RHSA-2021:4829 https://access.redhat.com/errata/RHSA-2021:4829

Comment 10 errata-xmlrpc 2021-12-01 12:26:17 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.7

Via RHSA-2021:4801 https://access.redhat.com/errata/RHSA-2021:4801

Comment 11 errata-xmlrpc 2021-12-02 18:35:13 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.6

Via RHSA-2021:4799 https://access.redhat.com/errata/RHSA-2021:4799

Comment 12 errata-xmlrpc 2021-12-02 22:01:15 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 3.11

Via RHSA-2021:4827 https://access.redhat.com/errata/RHSA-2021:4827

Comment 13 Product Security DevOps Team 2021-12-02 23:11:03 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-21698