Allocation of Resources Without Limits or Throttling in Jenkins and Jenkins LTS - CVE-2023-27901

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU73194

Allocation of Resources Without Limits or Throttling in Jenkins and Jenkins LTS - CVE-2023-27901

Published: March 9, 2023


Vulnerability identifier: #VU73194
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-27901
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to Apache Commons FileUpload does not limit the number of request parts within the StaplerRequest. A remote user can initiate a series of uploads and perform a denial of service (DoS) attack.


Affected software

Jenkins
Jenkins LTS
Oracle Communications Cloud Native Core Security Edge Protection Proxy
Oracle Communications Cloud Native Core Automated Test Suite
Oracle Communications Cloud Native Core Network Repository Function
jenkins (Red Hat package)
jenkins-2-plugins (Red Hat package)

How to mitigate CVE-2023-27901

Install updates from vendor's website.

Jenkins - update to 2.394
Jenkins LTS - addressed in versions 2.375.4, 2.387.1
jenkins (Red Hat package) - update to 2.387.3.1684911776-3.el8
jenkins-2-plugins (Red Hat package) - update to 4.13.1684911916-1.el8

External References

Related Security Bulletins