Bug 2222709 (CVE-2023-37946)

Summary:	CVE-2023-37946 Jenkins: Session fixation vulnerability in OpenShift Login Plugin
Product:	[Other] Security Response	Reporter:	Zack Miele <zmiele>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	abenaiss, dfreiber, ellin, jburrell, rogbas, scorneli, shbose, vkumar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	OpenShift Login Plugin 1.1.0.230.v5d7030b_f5432	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the Jenkins OpenShift Login Plugin. Affected versions of this plugin could allow a remote attacker to bypass security restrictions caused by not invalidating the existing session on login. By persuading a victim to visit a specially crafted Web site, an attacker can gain administrator access to Jenkins.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2222712

Description Zack Miele 2023-07-13 14:28:07 UTC

Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software.
https://www.jenkins.io/security/advisory/2023-07-12/

SECURITY-2998 / CVE-2023-37946
OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier does not
invalidate the existing session on login.

This allows attackers to use social engineering techniques to gain
administrator access to Jenkins.

Comment 7 errata-xmlrpc 2024-02-12 10:24:47 UTC

This issue has been addressed in the following products:

  OpenShift Developer Tools and Services for OCP 4.13

Via RHSA-2024:0776 https://access.redhat.com/errata/RHSA-2024:0776

Comment 8 errata-xmlrpc 2024-02-12 10:25:27 UTC

This issue has been addressed in the following products:

  OpenShift Developer Tools and Services for OCP 4.14

Via RHSA-2024:0777 https://access.redhat.com/errata/RHSA-2024:0777

Comment 9 errata-xmlrpc 2024-02-12 10:43:56 UTC

This issue has been addressed in the following products:

  OpenShift Developer Tools and Services for OCP 4.11

Via RHSA-2024:0775 https://access.redhat.com/errata/RHSA-2024:0775