SB2020013005 - Multiple vulnerabilities in Jenkins and LTS

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020013005

SB2020013005 - Multiple vulnerabilities in Jenkins and LTS

Published: January 30, 2020

Security Bulletin ID SB2020013005
Severity
Medium
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 secuirty vulnerabilities.


1) Clickjacking (CVE-ID: CVE-2020-2105)

The vulnerability allows a remote attacker to perform a clickjacking attack

The vulnerability exists due to the affected software does not serve the "X-Frame-Options: deny" HTTP header on REST API responses to protect against clickjacking attacks. A remote attacker can rout the victim through a specially crafted web page that embeds a REST API endpoint in an iframe and trick the user to perform an action which would allow for the attacker to learn the content of that REST API endpoint.


2) Information disclosure (CVE-ID: CVE-2020-2104)

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to the access to the chart requires no permissions beyond the general Overall/Read. A remote user with Overall/Read permission can gain unauthorized access to JVM memory usage data.


3) Information disclosure (CVE-ID: CVE-2020-2103)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the affected software exposes session identifiers on a user's detail object in the "/whoAmI" diagnostic page. A remote authenticated attacker can gain unauthorized access to sensitive information on the system.


4) Cryptographic issues (CVE-ID: CVE-2020-2102)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the affected software does not use a constant-time comparison when checking whether two HMACs are equal. A remote authenticated attacker can use statistical methods to obtain a valid HMAC for an attacker-controlled input value.


5) Information disclosure (CVE-ID: CVE-2020-2101)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the affected software does not use a constant-time comparison validating the connection secret when an inbound TCP agent connection is initiated. A remote authenticated attacker can use statistical methods to obtain the connection secret.


6) Resource management error (CVE-ID: CVE-2020-2100)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the UDP multicast/broadcast service can be used in an amplification reflection attack. A remote attacker can send spoofed UDP packets and cause a denial of service condition on the target system.


Remediation

Install update from vendor's website.

References