GHSA-gpxv-776p-7gc7 BIT-jenkins-2020-2100 CVE-2020-2100
Jenkins vulnerable to UDP amplification reflection attack
- Severity
- 5.8 / 10
- Medium · CVSS 3.0
- Exploit chance (EPSS)
- 3.44%
- Chance of exploitation in the next 30 days. Higher than 88.99% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-406 Insufficient Control of Network Message Volume (Network Amplification)
- Fix
2.204.2- Upgrade org.jenkins-ci.main:jenkins-core to this version or later
Description
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier supports two network discovery services (UDP multicast/broadcast and DNS multicast) by default.
The UDP multicast/broadcast service can be used in an amplification reflection attack, as very few bytes sent to the respective endpoint result in much larger responses: A single byte request to this service would respond with more than 100 bytes of Jenkins metadata which could be used in a DDoS attack on a Jenkins controller. Within the same network, spoofed UDP packets could also be sent to make two Jenkins controllers go into an infinite loop of replies to one another, thus causing a denial of service.
Jenkins 2.219, LTS 2.204.2 now disables both UDP multicast/broadcast and DNS multicast by default.
Administrators that need these features can re-enable them again by setting the system property hudson.DNSMultiCast.disabled to false (for DNS multicast) or the system property hudson.udp to 33848, or another port (for UDP broadcast/multicast). These are the same system properties that controlled whether these features were enabled in the past, so any instances explicitly enabling these features by setting these system properties will continue to have them enabled.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.jenkins-ci.main:jenkins-core | < 2.204.2 |
2.204.2 |
| org.jenkins-ci.main:jenkins-core | >= 2.205, < 2.219 |
2.219 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.jenkins-ci.main:jenkins-core Maven → 2.204.2
- maven
<dependency><groupId>org.jenkins-ci.main</groupId><artifactId>jenkins-core</artifactId><version>2.204.2</version></dependency>- gradle
implementation("org.jenkins-ci.main:jenkins-core:2.204.2")
Severity breakdown
CVSS 3.0 5.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Changed
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Weakness
CWE-406: Insufficient Control of Network Message Volume (Network Amplification)
The product does not sufficiently monitor or control transmitted network traffic volume, so that an actor can cause the product to transmit more traffic than should be allowed for that actor.
How to prevent it
- Architecture and Design: An application must make network resources available to a client commensurate with the client's access level.
- Policy: Define a clear policy for network resource allocation and consumption.
- Implementation: An application must, at all times, keep track of network resources and meter their usage appropriately.
References
Advisories
Packages
Other links
- github.com/jenkinsci/jenkins/commit/cd28a6d9347228b03da0e45653e23032342c2a36
- access.redhat.com/errata/RHBA-2020:0402
- access.redhat.com/errata/RHBA-2020:0675
- access.redhat.com/errata/RHSA-2020:0681
- access.redhat.com/errata/RHSA-2020:0683
- jenkins.io/security/advisory/2020-01-29
- openwall.com/lists/oss-security/2020/01/29/1
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-6f9g-cxwr-q5jr Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE | Critical Known exploited | Also affects org.jenkins-ci.main:jenkins-core |
| GHSA-8pqx-3rxx-f5pm Jenkins discloses project names via fingerprints | High Known exploited | Also affects org.jenkins-ci.main:jenkins-core |
| GHSA-26wc-3wqp-g3rp Deserialization of Untrusted Data in Jenkins | Critical Known exploited | Also affects org.jenkins-ci.main:jenkins-core |
| CVE-2018-1000861 Deserialization of Untrusted Data in Jenkins | Critical Known exploited | Also affects org.jenkins-ci.main:jenkins-core |
| GHSA-m6wv-wh8g-64xc Jenkins does not encrypt secrets from POST config.xml submissions before storing them in job configurations | Medium | Also affects org.jenkins-ci.main:jenkins-core |
| GHSA-93qh-vwrm-c5pw Jenkins: Stored XSS vulnerability in node offline cause description | Medium | Also affects org.jenkins-ci.main:jenkins-core |
| GHSA-92m7-4fpw-2wxm Jenkins: Open Redirect phishing attacks possible via "from" parameter in "Delegate to servlet container" | Medium | Also affects org.jenkins-ci.main:jenkins-core |
| GHSA-g28p-6mcc-v4rv Jenkins exposes other users' timezone and view names to users with Overall/Read permission | Medium | Also affects org.jenkins-ci.main:jenkins-core |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor