low
2.6
Advisory Published
CVE Published
Advisory Published
Updated

CVE-2013-0158

First published: Mon Jan 07 2013(Updated: )

It was reported [1] that Jenkins suffers from a vulnerability that allows an attacker with HTTP access to the server to retrieve the master cryptographic keys used by Jenkins to encrypt sensitive data in configuration files under $JENKINS_HOME, in HTML forms, the authenticate REST API access from users, and authenticating slaves connecting to the master. An attacker with this key could execute arbitrary code on the Jenkins master or impersonate arbitrary users via REST API calls. This can be somewhat mitigated, depending on certain installations: - this is only applicable on Jenkins instances that have slaves attached to them, and allow anonymous read access - regenerated API tokens, with a user can regenerate, cannot be impersonated by the attacker This is fixed upstream in version 1.498 and the LTS 1.480.2 version. In git, the fix seems to be spread across a few commits [1] <a href="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-01-04">https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-01-04</a> In git, the fix seems to be spread across a few commits (those prefixed with [SECURITY-49]): <a href="https://github.com/jenkinsci/jenkins/commit/a9aff088f327278a8873aef47fa8f80d3c5932fd">https://github.com/jenkinsci/jenkins/commit/a9aff088f327278a8873aef47fa8f80d3c5932fd</a> <a href="https://github.com/jenkinsci/jenkins/commit/4895eaafca468b7f0f1a3166b2fca7414f0d5da5">https://github.com/jenkinsci/jenkins/commit/4895eaafca468b7f0f1a3166b2fca7414f0d5da5</a> <a href="https://github.com/jenkinsci/jenkins/commit/c3d8e05a1b3d58b6c4dcff97394cb3a79608b4b2">https://github.com/jenkinsci/jenkins/commit/c3d8e05a1b3d58b6c4dcff97394cb3a79608b4b2</a> <a href="https://github.com/jenkinsci/jenkins/commit/3dc13b957b14cec649036e8dd517f0f9cb21fb04">https://github.com/jenkinsci/jenkins/commit/3dc13b957b14cec649036e8dd517f0f9cb21fb04</a> <a href="https://github.com/jenkinsci/jenkins/commit/94a8789b699132dd706021a6be1b78bc47f19602">https://github.com/jenkinsci/jenkins/commit/94a8789b699132dd706021a6be1b78bc47f19602</a>

Credit: secalert@redhat.com secalert@redhat.com

Affected SoftwareAffected VersionHow to fix
maven/org.jenkins-ci.main:jenkins-core<1.480.2
1.480.2
maven/org.jenkins-ci.main:jenkins-core>=1.481<1.498
1.498
Jenkins<=1.480.3.1
Jenkins LTS=1.400
Jenkins LTS=1.401
Jenkins LTS=1.402
Jenkins LTS=1.403
Jenkins LTS=1.404
Jenkins LTS=1.405
Jenkins LTS=1.406
Jenkins LTS=1.407
Jenkins LTS=1.408
Jenkins LTS=1.409
Jenkins LTS=1.410
Jenkins LTS=1.411
Jenkins LTS=1.412
Jenkins LTS=1.413
Jenkins LTS=1.414
Jenkins LTS=1.415
Jenkins LTS=1.416
Jenkins LTS=1.417
Jenkins LTS=1.418
Jenkins LTS=1.419
Jenkins LTS=1.420
Jenkins LTS=1.421
Jenkins LTS=1.422
Jenkins LTS=1.423
Jenkins LTS=1.424
Jenkins LTS=1.425
Jenkins LTS=1.426
Jenkins LTS=1.427
Jenkins LTS=1.428
Jenkins LTS=1.429
Jenkins LTS=1.430
Jenkins LTS=1.431
Jenkins LTS=1.432
Jenkins LTS=1.433
Jenkins LTS=1.434
Jenkins LTS=1.435
Jenkins LTS=1.436
Jenkins LTS=1.437
Jenkins=1.466.1.2
Jenkins=1.466.2.1
Jenkins=1.400
Jenkins=1.424
Jenkins=1.447
Jenkins LTS<=1.466.2
Jenkins LTS=1.409.1
Jenkins LTS=1.409.2
Jenkins LTS=1.409.3
Jenkins LTS=1.424.1
Jenkins LTS=1.424.2
Jenkins LTS=1.424.3
Jenkins LTS=1.424.4
Jenkins LTS=1.424.5
Jenkins LTS=1.424.6
Jenkins LTS=1.447.1
Jenkins LTS=1.447.2
Jenkins LTS=1.466.1
Jenkins=1.447.1.1
Jenkins=1.447.2.2
Jenkins=1.447.3.1

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2013-0158?

    CVE-2013-0158 has a severity rating that can vary but is generally considered a high-risk vulnerability due to the exposure of master cryptographic keys.

  • How do I fix CVE-2013-0158?

    To fix CVE-2013-0158, upgrade Jenkins to version 1.480.2 or later, or to version 1.498 if you have version 1.481 or newer.

  • What types of systems are affected by CVE-2013-0158?

    CVE-2013-0158 affects multiple versions of Jenkins and Cloudbees Jenkins, specifically versions prior to 1.480.2.

  • How can an attacker exploit CVE-2013-0158?

    An attacker can exploit CVE-2013-0158 by gaining HTTP access to the Jenkins server, allowing them to retrieve sensitive master cryptographic keys.

  • What data is compromised in CVE-2013-0158?

    CVE-2013-0158 compromises the master cryptographic keys used by Jenkins to encrypt sensitive data in configuration files.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203