XML injection in Jenkins and Jenkins LTS - CVE-2021-21604

Vulnerability identifier: #VU49526

CSH Severity: Medium

CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-21604

CWE-ID: CWE-91

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper handling of REST API XML deserialization errors. A remote authenticated attacker can pass specially crafted XML data to the application and perform arbitrary actions on the system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Jenkins
Jenkins LTS
Arch Linux
runc (Red Hat package)
cri-o (Red Hat package)
jenkins (Red Hat package)
conmon (Red Hat package)
jenkins (Alpine package)
python-rsa (Red Hat package)
openshift (Red Hat package)
machine-config-daemon (Red Hat package)
openshift-ansible (Red Hat package)
openshift-clients (Red Hat package)
openshift-kuryr (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
jenkins-2-plugins (Red Hat package)
Red Hat OpenShift Container Platform

Install updates from vendor's website.

Jenkins - update to 2.275
Jenkins LTS - update to 2.263.2
runc (Red Hat package) - addressed in versions 1.0.0-72.rhaos4.5.giteadfc6b.el8, 1.0.0-82.rhaos4.6.git086e841.el7, 1.0.0-82.rhaos4.6.git086e841.el8
cri-o (Red Hat package) - update to 1.19.1-7.rhaos4.6.git6377f68.el7
jenkins (Red Hat package) - addressed in versions 2.263.3.1612434332-1.el7, 2.263.3.1612434510-1.el8
conmon (Red Hat package) - addressed in versions 2.0.21-1.rhaos4.5.el7, 2.0.21-1.rhaos4.5.el8
jenkins (Alpine package) - update to 2.275-r0
python-rsa (Red Hat package) - update to 4.7-1.el8
openshift (Red Hat package) - addressed in versions 4.5.0-202102050524.p0.git.0.9229406.el7, 4.5.0-202102050524.p0.git.0.9229406.el8, 4.6.0-202102050212.p0.git.94265.716fcf8.el7, 4.6.0-202102050212.p0.git.94265.716fcf8.el8
machine-config-daemon (Red Hat package) - update to 4.5.0-202102050524.p0.git.2594.ff3b8c0.el8
openshift-ansible (Red Hat package) - addressed in versions 4.5.0-202102031005.p0.git.0.c6839a2.el7, 4.6.0-202102031649.p0.git.0.bf90f86.el7
openshift-clients (Red Hat package) - addressed in versions 4.5.0-202102051529.p0.git.3612.61b096a.el7, 4.5.0-202102051529.p0.git.3612.61b096a.el8, 4.6.0-202102050644.p0.git.3831.1c61c6b.el7, 4.6.0-202102050644.p0.git.3831.1c61c6b.el8
Red Hat OpenShift Container Platform - addressed in versions 4.5.33, 4.6.17
openshift-kuryr (Red Hat package) - update to 4.6.0-202102031810.p0.git.2225.a3ab872.el8
atomic-openshift-service-idler (Red Hat package) - update to 4.6.0-202102031810.p0.git.15.dcab90a.el8
jenkins-2-plugins (Red Hat package) - update to 4.6.1612257979-1.el8

• https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-1923

• Multiple vulnerabilities in Jenkins and Jenkins LTS
• XML injection in jenkins (Alpine package)
• Arch Linux update for jenkins
• Multiple vulnerabilities in OpenShift Container Platform
• Multiple vulnerabilities in OpenShift Container Platform