Information disclosure in Jenkins and Jenkins LTS - CVE-2023-27904

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU73197

Information disclosure in Jenkins and Jenkins LTS - CVE-2023-27904

Published: March 9, 2023


Vulnerability identifier: #VU73197
CSH Severity: Low
CVSS v4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-27904
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application within error stack traces related to agents. A remote user can gain unauthorized access to sensitive information on the system.


Affected software

Jenkins
Jenkins LTS
Multicluster Engine for Kubernetes
Red Hat OpenShift Container Platform
OpenShift Developer Tools and Services
toolbox (Red Hat package)
cri-o (Red Hat package)
haproxy (Red Hat package)
jenkins (Red Hat package)
openshift (Red Hat package)
openshift-clients (Red Hat package)
jenkins-2-plugins (Red Hat package)
kernel (Red Hat package)
kernel-rt (Red Hat package)

How to mitigate CVE-2023-27904

Install updates from vendor's website.

Jenkins - update to 2.394
Jenkins LTS - addressed in versions 2.375.4, 2.387.1
Multicluster Engine for Kubernetes - update to 2.2.4
Red Hat OpenShift Container Platform - update to 4.10.56
toolbox (Red Hat package) - update to 0.0.9-1.rhaos4.10.el8
cri-o (Red Hat package) - addressed in versions 1.23.5-8.rhaos4.10.gitcc8441d.el7, 1.23.5-8.rhaos4.10.gitcc8441d.el8
haproxy (Red Hat package) - update to 2.2.19-4.el8
jenkins (Red Hat package) - addressed in versions 2.387.1.1680701869-1.el8, 2.387.1.1683009763-3.el8, 2.387.1.1683009767-3.el8, 2.387.3.1684911776-3.el8, 2.401.1.1686680404-3.el8, 2.401.1.1686831596-3.el8, 2.414.3.1698293911-3.el8, 2.414.3.1698298955-3.el8, 2.426.3.1706515686-3.el8, 2.426.3.1706516929-3.el8
openshift (Red Hat package) - addressed in versions 4.10.0-202303221742.p0.g16bcd69.assembly.stream.el7, 4.10.0-202303221742.p0.g16bcd69.assembly.stream.el8
openshift-clients (Red Hat package) - addressed in versions 4.10.0-202304032041.p0.g3a7500d.assembly.stream.el7, 4.10.0-202304032041.p0.g3a7500d.assembly.stream.el8
jenkins-2-plugins (Red Hat package) - addressed in versions 4.10.1680703106-1.el8, 4.11.1683009941-1.el8, 4.11.1686831822-1.el8, 4.11.1698299029-1.el8, 4.11.1706516946-1.el8, 4.12.1683009955-1.el8, 4.12.1698294000-1.el8, 4.12.1706515741-1.el8, 4.13.1684911916-1.el8, 4.13.1686680473-1.el8
kernel (Red Hat package) - update to 4.18.0-305.85.1.el8_4
kernel-rt (Red Hat package) - update to 4.18.0-305.85.1.rt7.157.el8_4

External References

Related Security Bulletins