Missing Authorization in Jenkins LTS and Jenkins - CVE-2021-21697

Vulnerability identifier: #VU57990

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-21697

CWE-ID: CWE-862

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to the affected application allows any agent to read and write the contents of any build directory stored in Jenkins with very few restrictions. A remote attacker can compromise the target system.

Jenkins LTS
Jenkins
Arch Linux
coreos-installer (Red Hat package)
cri-o (Red Hat package)
jenkins (Red Hat package)
container-selinux (Red Hat package)
python-sushy (Red Hat package)
atomic-openshift (Red Hat package)
openshift-ansible (Red Hat package)
atomic-openshift-cluster-autoscaler (Red Hat package)
golang-github-prometheus-alertmanager (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
atomic-openshift-metrics-server (Red Hat package)
atomic-openshift-node-problem-detector (Red Hat package)
openshift-enterprise-autoheal (Red Hat package)
atomic-openshift-web-console (Red Hat package)
atomic-openshift-descheduler (Red Hat package)
openshift-enterprise-cluster-capacity (Red Hat package)
golang-github-openshift-oauth-proxy (Red Hat package)
golang-github-prometheus-node_exporter (Red Hat package)
atomic-enterprise-service-catalog (Red Hat package)
golang-github-prometheus-prometheus (Red Hat package)
atomic-openshift-dockerregistry (Red Hat package)
openshift-kuryr (Red Hat package)
jenkins-2-plugins (Red Hat package)
openshift (Red Hat package)
Red Hat OpenShift Container Platform

Install updates from vendor's website.

Jenkins LTS - update to 2.303.3
Jenkins - update to 2.319
coreos-installer (Red Hat package) - update to 0.9.0-8.rhaos4.8.el8
cri-o (Red Hat package) - addressed in versions 1.20.6-3.rhaos4.7.git4603183.el7, 1.20.6-3.rhaos4.7.git4603183.el8, 1.21.4-3.rhaos4.8.git84fa55d.el7, 1.21.4-3.rhaos4.8.git84fa55d.el8, 1.22.1-4.rhaos4.9.gite3dfe61.el7, 1.22.1-4.rhaos4.9.gite3dfe61.el8
jenkins (Red Hat package) - addressed in versions 2.303.3.1637595827-1.el8, 2.303.3.1637596565-1.el8, 2.303.3.1637597018-1.el8, 2.303.3.1637597493-1.el8, 2.303.3.1637698110-1.el7
container-selinux (Red Hat package) - update to 2.170.0-2.rhaos4.9.el8
python-sushy (Red Hat package) - addressed in versions 3.7.4-0.20211119091058.2cc60dc.el8, 3.12.1-0.20211122142104.806622c.el8
Red Hat OpenShift Container Platform - addressed in versions 3.11.569, 4.6.51, 4.7.38, 4.8.22, 4.9.9
atomic-openshift (Red Hat package) - update to 3.11.569-1.git.0.9dc951a.el7
openshift-ansible (Red Hat package) - update to 3.11.569-1.git.0.9620ba1.el7
atomic-openshift-cluster-autoscaler (Red Hat package) - update to 3.11.569-1.g99b2acf.el7
golang-github-prometheus-alertmanager (Red Hat package) - update to 3.11.569-1.g13de638.el7
atomic-openshift-service-idler (Red Hat package) - update to 3.11.569-1.g39cfc66.el7
atomic-openshift-metrics-server (Red Hat package) - update to 3.11.569-1.gf8bf728.el7
atomic-openshift-node-problem-detector (Red Hat package) - update to 3.11.569-1.gc8f26da.el7
openshift-enterprise-autoheal (Red Hat package) - update to 3.11.569-1.gf2f435d.el7
atomic-openshift-web-console (Red Hat package) - update to 3.11.569-1.g3e485e6.el7
atomic-openshift-descheduler (Red Hat package) - update to 3.11.569-1.gd435537.el7
openshift-enterprise-cluster-capacity (Red Hat package) - update to 3.11.569-1.g22be164.el7
golang-github-openshift-oauth-proxy (Red Hat package) - update to 3.11.569-1.gedebe84.el7
golang-github-prometheus-node_exporter (Red Hat package) - update to 3.11.569-1.g609cd20.el7
atomic-enterprise-service-catalog (Red Hat package) - update to 3.11.569-1.g2e6be86.el7
golang-github-prometheus-prometheus (Red Hat package) - update to 3.11.569-1.g99aae51.el7
atomic-openshift-dockerregistry (Red Hat package) - update to 3.11.569-1.g3571208.el7
openshift-kuryr (Red Hat package) - addressed in versions 3.11.569-1.g0c4bf66.el7, 4.6.0-202111041131.p0.git.7c5a4f7.assembly.stream.el8, 4.8.0-202111221627.p0.g43dd2f6.assembly.stream.el8, 4.9.0-202111221622.p0.g473fd0c.assembly.stream.el8
jenkins-2-plugins (Red Hat package) - addressed in versions 3.11.1637699107-1.el7, 4.6.1637602169-1.el8, 4.7.1637600997-1.el8, 4.8.1637599935-1.el8, 4.9.1637598812-1.el8
openshift (Red Hat package) - addressed in versions 4.6.0-202111100230.p0.git.6063298.assembly.stream.el7, 4.6.0-202111100230.p0.git.6063298.assembly.stream.el8, 4.7.0-202111192046.p0.gaa025a0.assembly.stream.el7, 4.7.0-202111192046.p0.gaa025a0.assembly.stream.el8, 4.8.0-202111221934.p0.g81bc627.assembly.stream.el7, 4.8.0-202111221934.p0.g81bc627.assembly.stream.el8, 4.9.0-202111231108.p0.g4dd1b5a.assembly.stream.el7, 4.9.0-202111231108.p0.g4dd1b5a.assembly.stream.el8

• https://jenkins.io/security/advisory/2021-11-04/

• Multiple vulnerabilities in Jenkins and Jenkins LTS
• Arch Linux update for jenkins
• Multiple vulnerabilities in OpenShift Container Platform 4.9
• Multiple vulnerabilities in OpenShift Container Platform 4.8
• Multiple vulnerabilities in OpenShift Container Platform 4.7
• Multiple vulnerabilities in OpenShift Container Platform 3.11
• Multiple vulnerabilities in OpenShift Container Platform 4.6