GHSA-qp4f-2w67-c8hw BIT-jenkins-2020-2099 CVE-2020-2099
Inbound TCP Agent Protocol/3 authentication bypass in Jenkins
- Severity
- 8.6 / 10
- High · CVSS 3.0
- Exploit chance (EPSS)
- 1.01%
- Chance of exploitation in the next 30 days. Higher than 63.22% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Fix
2.204.2- Upgrade org.jenkins-ci.main:jenkins-core to this version or later
Description
Jenkins 2.213 and earlier, LTS 2.204.1 and earlier includes support for the Inbound TCP Agent Protocol/3 for communication between controller and agents. While this protocol has been deprecated in 2018 and was recently removed from Jenkins in 2.214, it could still easily be enabled in Jenkins LTS 2.204.1, 2.213, and older.
This protocol incorrectly reuses encryption parameters which allow an unauthenticated remote attacker to determine the connection secret. This secret can then be used to connect attacker-controlled Jenkins agents to the Jenkins controller.
Jenkins 2.204.2 no longer allows for the use of Inbound TCP Agent Protocol/3 by default. The system property jenkins.slaves.JnlpSlaveAgentProtocol3.ALLOW_UNSAFE can be set to true to allow enabling the Inbound TCP Agent Protocol/3 in Jenkins 2.204.2, but doing so is strongly discouraged.
Inbound TCP Agent Protocol/3 was removed completely from Jenkins 2.214 and will not be part of Jenkins LTS after the end of the 2.204.x line.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.jenkins-ci.main:jenkins-core | < 2.204.2 |
2.204.2 |
| org.jenkins-ci.main:jenkins-core | >= 2.205, < 2.214 |
2.214 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.jenkins-ci.main:jenkins-core Maven → 2.204.2
- maven
<dependency><groupId>org.jenkins-ci.main</groupId><artifactId>jenkins-core</artifactId><version>2.204.2</version></dependency>- gradle
implementation("org.jenkins-ci.main:jenkins-core:2.204.2")
Severity breakdown
CVSS 3.0 8.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- Low
- Availability
- Low
Weakness
CWE-323: Reusing a Nonce, Key Pair in Encryption
Nonces should be used for the present occasion and only once.
How to prevent it
- Implementation: Refuse to reuse nonce values.
- Implementation: Use techniques such as requiring incrementing, time based and/or challenge response to assure uniqueness of nonces.
CWE-330: Use of Insufficiently Random Values
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
How to prevent it
- Architecture and Design: Use a well-vetted algorithm that is currently considered to be strong by experts in the field, and select well-tested implementations with adequate length seeds. In general, if a pseudo-random number generator is not advertised as being cryptographically secure, then it is probably a statistical PRNG and should not be used in security-sensitive contexts. Pseudo-random number generators can produce predictable numbers if the generator is known and the seed can be guessed. A 256-bit seed is a good starting point for producing a "random enough" number.
- Implementation: Consider a PRNG that re-seeds itself as needed from high quality pseudo-random output sources, such as hardware devices.
- Architecture and Design, Requirements: Use products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").
References
Advisories
Packages
Other links
- github.com/jenkinsci/jenkins/commit/5054bc6e12e1022993d719f66e289ab1d22ae854
- access.redhat.com/errata/RHBA-2020:0402
- access.redhat.com/errata/RHBA-2020:0675
- access.redhat.com/errata/RHSA-2020:0681
- access.redhat.com/errata/RHSA-2020:0683
- jenkins.io/security/advisory/2020-01-29
- openwall.com/lists/oss-security/2020/01/29/1
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-6f9g-cxwr-q5jr Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE | Critical Known exploited | Also affects org.jenkins-ci.main:jenkins-core |
| GHSA-8pqx-3rxx-f5pm Jenkins discloses project names via fingerprints | High Known exploited | Also affects org.jenkins-ci.main:jenkins-core |
| GHSA-26wc-3wqp-g3rp Deserialization of Untrusted Data in Jenkins | Critical Known exploited | Also affects org.jenkins-ci.main:jenkins-core |
| CVE-2018-1000861 Deserialization of Untrusted Data in Jenkins | Critical Known exploited | Also affects org.jenkins-ci.main:jenkins-core |
| GHSA-m6wv-wh8g-64xc Jenkins does not encrypt secrets from POST config.xml submissions before storing them in job configurations | Medium | Also affects org.jenkins-ci.main:jenkins-core |
| GHSA-93qh-vwrm-c5pw Jenkins: Stored XSS vulnerability in node offline cause description | Medium | Also affects org.jenkins-ci.main:jenkins-core |
| GHSA-92m7-4fpw-2wxm Jenkins: Open Redirect phishing attacks possible via "from" parameter in "Delegate to servlet container" | Medium | Also affects org.jenkins-ci.main:jenkins-core |
| GHSA-g28p-6mcc-v4rv Jenkins exposes other users' timezone and view names to users with Overall/Read permission | Medium | Also affects org.jenkins-ci.main:jenkins-core |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor