Improper Authentication in jenkins (Alpine package)

1) Improper Authentication

EUVDB-ID: #VU33179

Risk: High

CVSSv4.0: 7.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2019-1003049

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, because the fix for CVE-2019-1003004 in these releases did not reject existing remoting-based CLI authentication caches.

Mitigation

Install update from vendor's website.

Vulnerable software versions

jenkins (Alpine package): 2.73.3-r0 - 2.150.3-r0

CPE2.3

• cpe:2.3:o:alpine:jenkins_alpine_package:2.73.3-r0:*:*:*:*:alpine_linux:*:3.7
• cpe:2.3:o:alpine:jenkins_alpine_package:2.89.2-r0:*:*:*:*:alpine_linux:*:3.7
• cpe:2.3:o:alpine:jenkins_alpine_package:2.89.3-r0:*:*:*:*:alpine_linux:*:3.7

External links

https://git.alpinelinux.org/aports/commit/?id=4d6ca10f8ba57b07211d97a693e2c289bd1a9587
https://git.alpinelinux.org/aports/commit/?id=340842e8e1e352b407faa787d4fc974e58001d54

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.