Vulnerabilities > CVE-2018-1999043 - Missing Release of Resource after Effective Lifetime vulnerability in Jenkins

047910
CVSS 5.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
PARTIAL
network
low complexity
jenkins
CWE-772
nessus

Summary

A denial of service vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in BasicAuthenticationFilter.java, BasicHeaderApiTokenAuthenticator.java that allows attackers to create ephemeral in-memory user records by attempting to log in using invalid credentials.

Vulnerable Configurations

Part Description Count
Application
Jenkins
961

Common Attack Pattern Enumeration and Classification (CAPEC)

  • HTTP DoS
    An attacker performs flooding at the HTTP level to bring down only a particular web application rather than anything listening on a TCP/IP connection. This denial of service attack requires substantially fewer packets to be sent which makes DoS harder to detect. This is an equivalent of SYN flood in HTTP. The idea is to keep the HTTP session alive indefinitely and then repeat that hundreds of times. This attack targets resource depletion weaknesses in web server software. The web server will wait to attacker's responses on the initiated HTTP sessions while the connection threads are being exhausted.

Nessus

  • NASL familyCGI abuses
    NASL idJENKINS_2_138.NASL
    descriptionThe version of Jenkins running on the remote web server is prior to 2.138 or is a version of Jenkins LTS prior to 2.121.3. It is, therefore, affected by multiple vulnerabilities. Note that Nessus has not tested for these issues but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id117337
    published2018-09-06
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/117337
    titleJenkins < 2.121.3 / 2.138 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(117337);
      script_version("1.4");
      script_cvs_date("Date: 2019/11/01");
    
      script_cve_id(
        "CVE-2018-1999042",
        "CVE-2018-1999043",
        "CVE-2018-1999044",
        "CVE-2018-1999045",
        "CVE-2018-1999046",
        "CVE-2018-1999047"
      );
    
      script_name(english:"Jenkins < 2.121.3 / 2.138 Multiple Vulnerabilities");
      script_summary(english:"Checks the Jenkins version.");
    
      script_set_attribute(attribute:"synopsis", value:
    "A job scheduling and management system hosted on the remote web server
    is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The version of Jenkins running on the remote web server is prior to
    2.138 or is a version of Jenkins LTS prior to 2.121.3. It is,
    therefore, affected by multiple vulnerabilities.
    
    Note that Nessus has not tested for these issues but has instead
    relied only on the application's self-reported version number.");
      script_set_attribute(attribute:"see_also", value:"https://jenkins.io/security/advisory/2018-08-15/");
      script_set_attribute(attribute:"solution", value:
    "Upgrade Jenkins to version 2.138 or later, Jenkins LTS to version
    2.121.3 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-1999045");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/08/15");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/08/15");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/09/06");
    
      script_set_attribute(attribute:"plugin_type", value:"remote");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:cloudbees:jenkins");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"CGI abuses");
    
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("jenkins_detect.nasl");
      script_require_keys("www/Jenkins");
      script_require_ports("Services/www", 8080);
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("http.inc");
    include("vcf.inc");
    
    port = get_http_port(default:8080);
    
    app = vcf::get_app_info(app:"Jenkins", webapp:TRUE, port:port);
    
    if(app["LTS"])
      constraints = [{"fixed_version" : "2.121.3", "fixed_display" : "2.121.3 LTS / 2.138"}];
    else
      constraints = [{"fixed_version" : "2.138", "fixed_display" : "2.121.3 LTS / 2.138"}];
    
    vcf::check_version_and_report(app_info:app, constraints:constraints, severity:SECURITY_WARNING, strict:FALSE);
    
  • NASL familyCGI abuses
    NASL idJENKINS_2_146.NASL
    descriptionThe version of Jenkins running on the remote web server is prior to 2.146 or is a version of Jenkins LTS prior to 2.138.2. It is, therefore, affected by multiple vulnerabilities: - A cross-site scripting (XSS) vulnerability exists due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit this, by convincing a user to click a specially crafted URL, to execute arbitrary script code in a user
    last seen2020-06-01
    modified2020-06-02
    plugin id118147
    published2018-10-16
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/118147
    titleJenkins < 2.138.2 (LTS) / 2.146 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(118147);
      script_version("1.5");
      script_cvs_date("Date: 2019/11/01");
    
      script_cve_id(
        "CVE-2018-1000406",
        "CVE-2018-1000407",
        "CVE-2018-1000408",
        "CVE-2018-1000409",
        "CVE-2018-1000410",
        "CVE-2018-1000997",
        "CVE-2018-1999043"
      );
      script_bugtraq_id(106532);
      script_xref(name:"TRA", value:"TRA-2018-29");
    
      script_name(english:"Jenkins < 2.138.2 (LTS) / 2.146 Multiple Vulnerabilities");
      script_summary(english:"Checks the Jenkins version.");
    
      script_set_attribute(attribute:"synopsis", value:
    "A job scheduling and management system hosted on the remote web server is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The version of Jenkins running on the remote web server is prior to 2.146 or is a version of Jenkins LTS prior to 
    2.138.2. It is, therefore, affected by multiple vulnerabilities:
      - A cross-site scripting (XSS) vulnerability exists due to improper validation of user-supplied input before 
        returning it to users. An unauthenticated, remote attacker can exploit this, by convincing a user to click a 
        specially crafted URL, to execute arbitrary script code in a user's browser session (CVE-2018-1000407).
    
      - A denial of service (DoS) vulnerability exists in the HudsonPrivateSecurityRealm class of Jenkins. An 
        unauthenticated, remote attacker can exploit this issue, by sending crafted, repeated HTTP requests to particular 
        URLs, to cause the application to stop responding (CVE-2018-1000408).
    
      - A directory traversal vulnerability exists in the version of the Stapler Web Framework, which is bundled with 
        Jenkins. An authenticated, remote attacker can exploit this, by sending a URI that contains directory traversal 
        characters, to disclose the contents of files located outside of the server's restricted path (CVE-2018-1000997).
    
    Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version 
    number.");
      script_set_attribute(attribute:"see_also", value:"https://jenkins.io/security/advisory/2018-10-10/");
      script_set_attribute(attribute:"see_also", value:"https://www.tenable.com/security/research/tra-2018-29");
      script_set_attribute(attribute:"solution", value:
    "Upgrade Jenkins to version 2.146 or later, Jenkins LTS to version 
    2.138.2 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-1000408");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/10/10");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/10/10");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/10/16");
    
      script_set_attribute(attribute:"plugin_type", value:"remote");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:cloudbees:jenkins");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"CGI abuses");
    
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("jenkins_detect.nasl");
      script_require_keys("www/Jenkins");
      script_require_ports("Services/www", 8080);
    
      exit(0);
    }
    
    include('http.inc');
    include('vcf.inc');
    include('vcf_extras.inc');
    
    port = get_http_port(default:8080);
    app_info = vcf::get_app_info(app:'Jenkins', port:port, webapp:TRUE);
    
    constraints = [
      {'edition':'Open Source', 'fixed_version':'2.146'},
      {'edition':'Open Source LTS', 'fixed_version':'2.138.2'}
    ];
    vcf::jenkins::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);
    

Redhat

rpms
  • atomic-enterprise-service-catalog-1:3.11.51-1.git.1671.2d16650.el7
  • atomic-enterprise-service-catalog-svcat-1:3.11.51-1.git.1671.2d16650.el7
  • atomic-openshift-0:3.11.51-1.git.0.1560686.el7
  • atomic-openshift-clients-0:3.11.51-1.git.0.1560686.el7
  • atomic-openshift-clients-redistributable-0:3.11.51-1.git.0.1560686.el7
  • atomic-openshift-cluster-autoscaler-0:3.11.51-1.git.0.0aa9fc2.el7
  • atomic-openshift-descheduler-0:3.11.51-1.git.300.89070e8.el7
  • atomic-openshift-docker-excluder-0:3.11.51-1.git.0.1560686.el7
  • atomic-openshift-dockerregistry-0:3.11.51-1.git.446.d29ce0e.el7
  • atomic-openshift-excluder-0:3.11.51-1.git.0.1560686.el7
  • atomic-openshift-hyperkube-0:3.11.51-1.git.0.1560686.el7
  • atomic-openshift-hypershift-0:3.11.51-1.git.0.1560686.el7
  • atomic-openshift-master-0:3.11.51-1.git.0.1560686.el7
  • atomic-openshift-metrics-server-0:3.11.51-1.git.52.03e3a91.el7
  • atomic-openshift-node-0:3.11.51-1.git.0.1560686.el7
  • atomic-openshift-node-problem-detector-0:3.11.51-1.git.254.22189b0.el7
  • atomic-openshift-pod-0:3.11.51-1.git.0.1560686.el7
  • atomic-openshift-sdn-ovs-0:3.11.51-1.git.0.1560686.el7
  • atomic-openshift-service-idler-0:3.11.51-1.git.14.813574a.el7
  • atomic-openshift-template-service-broker-0:3.11.51-1.git.0.1560686.el7
  • atomic-openshift-tests-0:3.11.51-1.git.0.1560686.el7
  • atomic-openshift-web-console-0:3.11.51-1.git.324.0ae64ed.el7
  • cri-o-0:1.11.10-1.rhaos3.11.git42c86f0.el7
  • cri-o-debuginfo-0:1.11.10-1.rhaos3.11.git42c86f0.el7
  • golang-github-openshift-oauth-proxy-0:3.11.51-1.git.419.1af74df.el7
  • jenkins-0:2.138.2.1542054911-1.el7
  • jenkins-2-plugins-0:3.11.1542061886-1.el7
  • kibana-0:5.6.13-1.el7
  • kibana-debuginfo-0:5.6.13-1.el7
  • openshift-ansible-0:3.11.51-2.git.0.51c90a3.el7
  • openshift-ansible-docs-0:3.11.51-2.git.0.51c90a3.el7
  • openshift-ansible-playbooks-0:3.11.51-2.git.0.51c90a3.el7
  • openshift-ansible-roles-0:3.11.51-2.git.0.51c90a3.el7
  • openshift-ansible-test-0:3.11.51-2.git.0.51c90a3.el7
  • openshift-enterprise-autoheal-0:3.11.51-1.git.219.8ea4275.el7
  • openshift-enterprise-cluster-capacity-0:3.11.51-1.git.380.ffa21af.el7
  • openshift-monitor-project-lifecycle-0:3.11.51-1.git.59.7b59e29.el7
  • openshift-monitor-sample-app-0:3.11.51-1.git.5.f6d0188.el7
  • prometheus-0:3.11.51-1.git.5023.0ad933c.el7
  • prometheus-alertmanager-0:3.11.51-1.git.0.50a0687.el7
  • prometheus-node-exporter-0:3.11.51-1.git.1063.12dd8be.el7