[Bug 1797080] New: CVE-2020-2099 jenkins: Inbound TCP Agent Protocol/3 authentication bypass

List overview All Threads
Download

newer

older

[Bug 1799477] New: CVE-2020-5398...

[Bug 1797081] New: CVE-2020-2099...

bugzilla＠redhat.com

31 Jan 2020 31 Jan '20

8:59 p.m.

https://bugzilla.redhat.com/show_bug.cgi?id=1797080

Bug ID: 1797080 Summary: CVE-2020-2099 jenkins: Inbound TCP Agent Protocol/3 authentication bypass Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: psampaio@redhat.com CC: abenaiss@redhat.com, adam.kaplan@redhat.com, aos-bugs@redhat.com, bmontgom@redhat.com, eparis@redhat.com, extras-orphan@fedoraproject.org, java-sig-commits@lists.fedoraproject.org, jburrell@redhat.com, jokerman@redhat.com, mizdebsk@redhat.com, msrb@redhat.com, nstielau@redhat.com, pbhattac@redhat.com, sponnaga@redhat.com, vbobade@redhat.com, wzheng@redhat.com Target Milestone: --- Classification: Other

Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents, which can be used to connect to Jenkins, impersonating those agents.

References:

https://jenkins.io/security/advisory/2020-01-29/#SECURITY-1682 http://www.openwall.com/lists/oss-security/2020/01/29/1

-- You are receiving this mail because: You are on the CC list for the bug.

Show replies by date

bugzilla＠redhat.com

31 Jan 31 Jan

8:59 p.m.

New subject: [Bug 1797080] CVE-2020-2099 jenkins: Inbound TCP Agent Protocol/3 authentication bypass

https://bugzilla.redhat.com/show_bug.cgi?id=1797080

Pedro Sampaio psampaio@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1797081

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1797081 [Bug 1797081] CVE-2020-2099 jenkins: Inbound TCP Agent Protocol/3 authentication bypass [fedora-all]

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

8:59 p.m.

New subject: [Bug 1797080] CVE-2020-2099 jenkins: Inbound TCP Agent Protocol/3 authentication bypass

https://bugzilla.redhat.com/show_bug.cgi?id=1797080

--- Comment #1 from Pedro Sampaio psampaio@redhat.com --- Created jenkins tracking bugs for this issue:

Affects: fedora-all [bug 1797081]

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

9:13 p.m.

New subject: [Bug 1797080] CVE-2020-2099 jenkins: Inbound TCP Agent Protocol/3 authentication bypass

https://bugzilla.redhat.com/show_bug.cgi?id=1797080

Pedro Sampaio psampaio@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1797089

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

1 Feb 1 Feb

1:07 a.m.

New subject: [Bug 1797080] CVE-2020-2099 jenkins: Inbound TCP Agent Protocol/3 authentication bypass

https://bugzilla.redhat.com/show_bug.cgi?id=1797080

Sam Fowler sfowler@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

1:47 a.m.

New subject: [Bug 1797080] CVE-2020-2099 jenkins: Inbound TCP Agent Protocol/3 authentication bypass

https://bugzilla.redhat.com/show_bug.cgi?id=1797080

Sam Fowler sfowler@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1797143

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

1:49 a.m.

New subject: [Bug 1797080] CVE-2020-2099 jenkins: Inbound TCP Agent Protocol/3 authentication bypass

https://bugzilla.redhat.com/show_bug.cgi?id=1797080

Sam Fowler sfowler@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1797144

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

1:53 a.m.

New subject: [Bug 1797080] CVE-2020-2099 jenkins: Inbound TCP Agent Protocol/3 authentication bypass

https://bugzilla.redhat.com/show_bug.cgi?id=1797080

Sam Fowler sfowler@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1797146

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

2:01 a.m.

New subject: [Bug 1797080] CVE-2020-2099 jenkins: Inbound TCP Agent Protocol/3 authentication bypass

https://bugzilla.redhat.com/show_bug.cgi?id=1797080

--- Comment #5 from Sam Fowler sfowler@redhat.com --- "Any security advisory related updates to Jenkins core or the plugins we include in the OpenShift Jenkins master image will only occur in the v3.11 and v4.x branches of this repository."

https://github.com/openshift/jenkins/blob/master/README.md#jenkins-security-...

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

3 Mar 3 Mar

9:07 a.m.

New subject: [Bug 1797080] CVE-2020-2099 jenkins: Inbound TCP Agent Protocol/3 authentication bypass

https://bugzilla.redhat.com/show_bug.cgi?id=1797080

--- Comment #6 from Akram Ben Aissi abenaiss@redhat.com --- This bug has been fixed by https://errata.devel.redhat.com/advisory/50532 that brought Jenkins 2.204.2

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

12 Mar 12 Mar

8:52 p.m.

New subject: [Bug 1797080] CVE-2020-2099 jenkins: Inbound TCP Agent Protocol/3 authentication bypass

https://bugzilla.redhat.com/show_bug.cgi?id=1797080

Akram Ben Aissi abenaiss@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1813070

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

2 Jul 2 Jul

4:31 p.m.

New subject: [Bug 1797080] CVE-2020-2099 jenkins: Inbound TCP Agent Protocol/3 authentication bypass

https://bugzilla.redhat.com/show_bug.cgi?id=1797080

--- Doc Text *updated* by Eric Christensen sparks@redhat.com --- A flaw was found in Jenkins. Encryption key parameters are improperly reused in the Inbound TCP Agent Protocol/3 allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents. The highest threat from this vulnerability is to data confidentiality.

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

26 Aug 26 Aug

5:38 p.m.

New subject: [Bug 1797080] CVE-2020-2099 jenkins: Inbound TCP Agent Protocol/3 authentication bypass

https://bugzilla.redhat.com/show_bug.cgi?id=1797080

Vibhav Bobade vbobade@redhat.com changed:

--- Comment #7 from Vibhav Bobade vbobade@redhat.com --- Closing as bug is already fixed

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

27 Aug 27 Aug

5:20 a.m.

New subject: [Bug 1797080] CVE-2020-2099 jenkins: Inbound TCP Agent Protocol/3 authentication bypass

https://bugzilla.redhat.com/show_bug.cgi?id=1797080

Sam Fowler sfowler@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

3:48 p.m.

New subject: [Bug 1797080] CVE-2020-2099 jenkins: Inbound TCP Agent Protocol/3 authentication bypass

https://bugzilla.redhat.com/show_bug.cgi?id=1797080

Vikas Laad vlaad@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1873172

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

24 Nov 24 Nov

7:15 p.m.

New subject: [Bug 1797080] CVE-2020-2099 jenkins: Inbound TCP Agent Protocol/3 authentication bypass

https://bugzilla.redhat.com/show_bug.cgi?id=1797080 Bug 1797080 depends on bug 1797081, which changed state.

Bug 1797081 Summary: CVE-2020-2099 jenkins: Inbound TCP Agent Protocol/3 authentication bypass [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1797081

What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |EOL

-- You are receiving this mail because: You are on the CC list for the bug.

1313

Age (days ago)

1611

Last active (days ago)

java-sig-commits@lists.fedoraproject.org

15 comments

1 participants

tags (0)

participants (1)

bugzilla＠redhat.com