Jenkins Multiple Security Vulnerabilities

Bugtraq ID:	106176
Class:	Input Validation Error
CVE:	CVE-2018-1000861 CVE-2018-1000862 CVE-2018-1000863 CVE-2018-1000864
Remote:	Yes
Local:	No
Published:	Dec 05 2018 12:00AM
Updated:	Dec 05 2018 12:00AM
Credit:	Information Security; Evan Grant of Tenable; and Orange Tsai(@orange_8361) from DEVCORE, Apple Information Security, Nimrod Stoler of CyberArk Labs, and, independently, Evan Grant of Tenable, and Denis Shvedchenko, Sphere, Inc
Vulnerable:	Jenkins-Ci Jenkins LTS 2.138.3 Jenkins-Ci Jenkins LTS 2.89.4 Jenkins-Ci Jenkins LTS 2.89.3 Jenkins-Ci Jenkins LTS 2.73.3 Jenkins-Ci Jenkins LTS 2.73.2 Jenkins-Ci Jenkins LTS 2.73.1 Jenkins-Ci Jenkins LTS 2.46.2 Jenkins-Ci Jenkins LTS 2.46.1 Jenkins-Ci Jenkins LTS 2.32.2 Jenkins-Ci Jenkins LTS 2.32.1 Jenkins-Ci Jenkins LTS 2.19.3 Jenkins-Ci Jenkins LTS 2.19.2 Jenkins-Ci Jenkins LTS 1.652.2 Jenkins-Ci Jenkins LTS 1.651.2 Jenkins-Ci Jenkins LTS 1.651.1 Jenkins-Ci Jenkins LTS 1.642.2 Jenkins-Ci Jenkins LTS 1.642.1 Jenkins-Ci Jenkins LTS 1.625.3 Jenkins-Ci Jenkins LTS 1.625.2 Jenkins-Ci Jenkins LTS 1.625.1 Jenkins-Ci Jenkins LTS 1.609.1 Jenkins-Ci Jenkins LTS 1.580.1 Jenkins-Ci Jenkins LTS 1.565.3 Jenkins-Ci Jenkins LTS 2.107.2 Jenkins-Ci Jenkins LTS 2.107.1 Jenkins-Ci Jenkins 1.480.3 Jenkins-Ci Jenkins 1.480.2 Jenkins-Ci Jenkins 1.480.1 Jenkins-Ci Jenkins 1.409.3 Jenkins-Ci Jenkins 1.7.24 Jenkins-Ci Jenkins 2.93 Jenkins-Ci Jenkins 2.92 Jenkins-Ci Jenkins 2.90 Jenkins-Ci Jenkins 2.89 Jenkins-Ci Jenkins 2.88 Jenkins-Ci Jenkins 2.84 Jenkins-Ci Jenkins 2.83 Jenkins-Ci Jenkins 2.57 Jenkins-Ci Jenkins 2.56 Jenkins-Ci Jenkins 2.44 Jenkins-Ci Jenkins 2.43 Jenkins-Ci Jenkins 2.32 Jenkins-Ci Jenkins 2.31 Jenkins-Ci Jenkins 2.3 Jenkins-Ci Jenkins 2.2 Jenkins-Ci Jenkins 2.153 Jenkins-Ci Jenkins 2.116 Jenkins-Ci Jenkins 2.115 Jenkins-Ci Jenkins 2.107 Jenkins-Ci Jenkins 2.106 Jenkins-Ci Jenkins 2.1 Jenkins-Ci Jenkins 2.0 Jenkins-Ci Jenkins 1.7.24.1 Jenkins-Ci Jenkins 1.656 Jenkins-Ci Jenkins 1.655 Jenkins-Ci Jenkins 1.654 Jenkins-Ci Jenkins 1.653 Jenkins-Ci Jenkins 1.652 Jenkins-Ci Jenkins 1.651 Jenkins-Ci Jenkins 1.650 Jenkins-Ci Jenkins 1.649 Jenkins-Ci Jenkins 1.641 Jenkins-Ci Jenkins 1.640 Jenkins-Ci Jenkins 1.638 Jenkins-Ci Jenkins 1.637 Jenkins-Ci Jenkins 1.600 Jenkins-Ci Jenkins 1.587 Jenkins-Ci Jenkins 1.578 Jenkins-Ci Jenkins 1.551 Jenkins-Ci Jenkins 1.550 Jenkins-Ci Jenkins 1.532.2 Jenkins-Ci Jenkins 1.532.1 Jenkins-Ci Jenkins 1.523 Jenkins-Ci Jenkins 1.514 Jenkins-Ci Jenkins 1.513 Jenkins-Ci Jenkins 1.509.1 Jenkins-Ci Jenkins 1.509 Jenkins-Ci Jenkins 1.502 Jenkins-Ci Jenkins 1.497 Jenkins-Ci Jenkins 1.491 Jenkins-Ci Jenkins 1.482 Jenkins-Ci Jenkins 1.454 Jenkins-Ci Jenkins 1.452 Jenkins-Ci Jenkins 1.451 Jenkins-Ci Jenkins 1.447 Jenkins-Ci Jenkins 1.446 Jenkins-Ci Jenkins 1.438 Jenkins-Ci Jenkins 1.424.5.1 Jenkins-Ci Jenkins 1.424.5 Jenkins-Ci Jenkins 1.424.3 Jenkins-Ci Jenkins 1.424.2 Jenkins-Ci Jenkins 1.424.1 Jenkins-Ci Jenkins 1.408 Jenkins-Ci Jenkins 1.400.0.13 Jenkins-Ci Jenkins 1.400.0.12
Not Vulnerable:	Jenkins-Ci Jenkins LTS 2.150.1 Jenkins-Ci Jenkins LTS 2.138.4 Jenkins-Ci Jenkins 2.154

Jenkins Multiple Security Vulnerabilities

Jenkins is prone to multiple security vulnerabilities.

An attacker may leverage these issues to execute arbitrary code, perform unauthorized actions or gain access to sensitive information that may aid in further attacks. Failed attempts will likely cause a denial-of-service condition.

Jenkins Multiple Security Vulnerabilities

The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.

Jenkins Multiple Security Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Jenkins Multiple Security Vulnerabilities

References:

• Jenkins CI Homepage (Jenkins CI)
  
• Jenkins Security Advisory 2018-12-05 (Jenkins-Ci)
  
• [R2] Jenkins Forced Migration of User Records (Tenable)