[Bug 1797065] New: CVE-2020-2104 jenkins: Memory usage graphs accessible to anyone with Overall/Read

https://bugzilla.redhat.com/show_bug.cgi?id=1797065

Bug ID: 1797065
           Summary: CVE-2020-2104 jenkins: Memory usage graphs accessible
                    to anyone with Overall/Read
           Product: Security Response
          Hardware: All
                OS: Linux
            Status: NEW
         Component: vulnerability
          Keywords: Security
          Severity: low
          Priority: low
          Assignee: [e-mail]
          Reporter: [e-mail]
                CC: [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail]
  Target Milestone: ---
    Classification: Other

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier allowed users with
Overall/Read access to view a JVM memory usage chart.

References:

https://jenkins.io/security/advisory/2020-01-29/#SECURITY-1650
http://www.openwall.com/lists/oss-security/2020/01/29/1

[Bug 1797065] CVE-2020-2104 jenkins: Memory usage graphs accessible to anyone with Overall/Read

https://bugzilla.redhat.com/show_bug.cgi?id=1797065

Pedro Sampaio  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1797066

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1797066
[Bug 1797066] CVE-2020-2104 jenkins: Memory usage graphs accessible to anyone
with Overall/Read [fedora-all]

[Bug 1797065] CVE-2020-2104 jenkins: Memory usage graphs accessible to anyone with Overall/Read

https://bugzilla.redhat.com/show_bug.cgi?id=1797065

--- Comment #1 from Pedro Sampaio  ---
Created jenkins tracking bugs for this issue:

Affects: fedora-all [bug 1797066]

[Bug 1797065] CVE-2020-2104 jenkins: Memory usage graphs accessible to anyone with Overall/Read

https://bugzilla.redhat.com/show_bug.cgi?id=1797065

Pedro Sampaio  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |1797089

[Bug 1797065] CVE-2020-2104 jenkins: Memory usage graphs accessible to anyone with Overall/Read

https://bugzilla.redhat.com/show_bug.cgi?id=1797065

Sam Fowler  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1797143

[Bug 1797065] CVE-2020-2104 jenkins: Memory usage graphs accessible to anyone with Overall/Read

https://bugzilla.redhat.com/show_bug.cgi?id=1797065

Sam Fowler  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1797144

[Bug 1797065] CVE-2020-2104 jenkins: Memory usage graphs accessible to anyone with Overall/Read

https://bugzilla.redhat.com/show_bug.cgi?id=1797065

Sam Fowler  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1797146

[Bug 1797065] CVE-2020-2104 jenkins: Memory usage graphs accessible to anyone with Overall/Read

https://bugzilla.redhat.com/show_bug.cgi?id=1797065

--- Comment #4 from Sam Fowler  ---
"Any security advisory related updates to Jenkins core or the plugins we
include in the OpenShift Jenkins master image will only occur in the v3.11 and
v4.x branches of this repository."

https://github.com/openshift/jenkins/blob/master/README.md#jenkins-security-...

[Bug 1797065] CVE-2020-2104 jenkins: Memory usage graphs accessible to anyone with Overall/Read

https://bugzilla.redhat.com/show_bug.cgi?id=1797065

--- Comment #5 from Akram Ben Aissi  ---
This bug has been fixed by https://errata.devel.redhat.com/advisory/50532 that
brought Jenkins 2.204.2

[Bug 1797065] CVE-2020-2104 jenkins: Memory usage graphs accessible to anyone with Overall/Read

https://bugzilla.redhat.com/show_bug.cgi?id=1797065

Akram Ben Aissi  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1813070

[Bug 1797065] CVE-2020-2104 jenkins: Memory usage graphs accessible to anyone with Overall/Read

https://bugzilla.redhat.com/show_bug.cgi?id=1797065

Vikas Laad  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1873172

[Bug 1797065] CVE-2020-2104 jenkins: Memory usage graphs accessible to anyone with Overall/Read

https://bugzilla.redhat.com/show_bug.cgi?id=1797065
Bug 1797065 depends on bug 1797066, which changed state.

Bug 1797066 Summary: CVE-2020-2104 jenkins: Memory usage graphs accessible to anyone with Overall/Read [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1797066

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |CLOSED
         Resolution|---                         |EOL

[Bug 1797065] CVE-2020-2104 jenkins: Memory usage graphs accessible to anyone with Overall/Read

https://bugzilla.redhat.com/show_bug.cgi?id=1797065

Sam Fowler  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |ERRATA
             Status|NEW                         |CLOSED
        Last Closed|                            |2021-10-28 00:40:22