Protection Mechanism Failure in Jenkins LTS and Jenkins - CVE-2021-21690

Vulnerability identifier: #VU57983

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-21690

CWE-ID: CWE-693

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path. An attacker can bypass implemented security restrictions and elevate privileges on the system.

Jenkins LTS
Jenkins
Arch Linux
coreos-installer (Red Hat package)
cri-o (Red Hat package)
jenkins (Red Hat package)
container-selinux (Red Hat package)
python-sushy (Red Hat package)
atomic-openshift (Red Hat package)
openshift-ansible (Red Hat package)
atomic-openshift-cluster-autoscaler (Red Hat package)
golang-github-prometheus-alertmanager (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
atomic-openshift-metrics-server (Red Hat package)
atomic-openshift-node-problem-detector (Red Hat package)
openshift-enterprise-autoheal (Red Hat package)
atomic-openshift-web-console (Red Hat package)
atomic-openshift-descheduler (Red Hat package)
openshift-enterprise-cluster-capacity (Red Hat package)
golang-github-openshift-oauth-proxy (Red Hat package)
golang-github-prometheus-node_exporter (Red Hat package)
atomic-enterprise-service-catalog (Red Hat package)
golang-github-prometheus-prometheus (Red Hat package)
atomic-openshift-dockerregistry (Red Hat package)
openshift-kuryr (Red Hat package)
jenkins-2-plugins (Red Hat package)
openshift (Red Hat package)
Red Hat OpenShift Container Platform

Install updates from vendor's website.

Jenkins LTS - update to 2.303.3
Jenkins - update to 2.319
coreos-installer (Red Hat package) - update to 0.9.0-8.rhaos4.8.el8
cri-o (Red Hat package) - addressed in versions 1.20.6-3.rhaos4.7.git4603183.el7, 1.20.6-3.rhaos4.7.git4603183.el8, 1.21.4-3.rhaos4.8.git84fa55d.el7, 1.21.4-3.rhaos4.8.git84fa55d.el8, 1.22.1-4.rhaos4.9.gite3dfe61.el7, 1.22.1-4.rhaos4.9.gite3dfe61.el8
jenkins (Red Hat package) - addressed in versions 2.303.3.1637595827-1.el8, 2.303.3.1637596565-1.el8, 2.303.3.1637597018-1.el8, 2.303.3.1637597493-1.el8, 2.303.3.1637698110-1.el7
container-selinux (Red Hat package) - update to 2.170.0-2.rhaos4.9.el8
python-sushy (Red Hat package) - addressed in versions 3.7.4-0.20211119091058.2cc60dc.el8, 3.12.1-0.20211122142104.806622c.el8
Red Hat OpenShift Container Platform - addressed in versions 3.11.569, 4.6.51, 4.7.38, 4.8.22, 4.9.9
atomic-openshift (Red Hat package) - update to 3.11.569-1.git.0.9dc951a.el7
openshift-ansible (Red Hat package) - update to 3.11.569-1.git.0.9620ba1.el7
atomic-openshift-cluster-autoscaler (Red Hat package) - update to 3.11.569-1.g99b2acf.el7
golang-github-prometheus-alertmanager (Red Hat package) - update to 3.11.569-1.g13de638.el7
atomic-openshift-service-idler (Red Hat package) - update to 3.11.569-1.g39cfc66.el7
atomic-openshift-metrics-server (Red Hat package) - update to 3.11.569-1.gf8bf728.el7
atomic-openshift-node-problem-detector (Red Hat package) - update to 3.11.569-1.gc8f26da.el7
openshift-enterprise-autoheal (Red Hat package) - update to 3.11.569-1.gf2f435d.el7
atomic-openshift-web-console (Red Hat package) - update to 3.11.569-1.g3e485e6.el7
atomic-openshift-descheduler (Red Hat package) - update to 3.11.569-1.gd435537.el7
openshift-enterprise-cluster-capacity (Red Hat package) - update to 3.11.569-1.g22be164.el7
golang-github-openshift-oauth-proxy (Red Hat package) - update to 3.11.569-1.gedebe84.el7
golang-github-prometheus-node_exporter (Red Hat package) - update to 3.11.569-1.g609cd20.el7
atomic-enterprise-service-catalog (Red Hat package) - update to 3.11.569-1.g2e6be86.el7
golang-github-prometheus-prometheus (Red Hat package) - update to 3.11.569-1.g99aae51.el7
atomic-openshift-dockerregistry (Red Hat package) - update to 3.11.569-1.g3571208.el7
openshift-kuryr (Red Hat package) - addressed in versions 3.11.569-1.g0c4bf66.el7, 4.6.0-202111041131.p0.git.7c5a4f7.assembly.stream.el8, 4.8.0-202111221627.p0.g43dd2f6.assembly.stream.el8, 4.9.0-202111221622.p0.g473fd0c.assembly.stream.el8
jenkins-2-plugins (Red Hat package) - addressed in versions 3.11.1637699107-1.el7, 4.6.1637602169-1.el8, 4.7.1637600997-1.el8, 4.8.1637599935-1.el8, 4.9.1637598812-1.el8
openshift (Red Hat package) - addressed in versions 4.6.0-202111100230.p0.git.6063298.assembly.stream.el7, 4.6.0-202111100230.p0.git.6063298.assembly.stream.el8, 4.7.0-202111192046.p0.gaa025a0.assembly.stream.el7, 4.7.0-202111192046.p0.gaa025a0.assembly.stream.el8, 4.8.0-202111221934.p0.g81bc627.assembly.stream.el7, 4.8.0-202111221934.p0.g81bc627.assembly.stream.el8, 4.9.0-202111231108.p0.g4dd1b5a.assembly.stream.el7, 4.9.0-202111231108.p0.g4dd1b5a.assembly.stream.el8

• https://jenkins.io/security/advisory/2021-11-04/

• Multiple vulnerabilities in Jenkins and Jenkins LTS
• Arch Linux update for jenkins
• Multiple vulnerabilities in OpenShift Container Platform 4.9
• Multiple vulnerabilities in OpenShift Container Platform 4.8
• Multiple vulnerabilities in OpenShift Container Platform 4.7
• Multiple vulnerabilities in OpenShift Container Platform 3.11
• Multiple vulnerabilities in OpenShift Container Platform 4.6