CVE-2017-1000362: Infoleak
The re-key admin monitor was introduced in Jenkins 1.498 and re-encrypted all secrets in JENKINSHOME with a new key. It also created a backup directory with all old secrets, and the key used to encrypt them. These backups were world-readable and not removed afterwards. Jenkins now deletes the backup directory, if present. Upgrading from before 1.498 will no longer create a backup directory. Administrators relying on file access permissions in their manually created backups are advised to check them for the directory $JENKINSHOME/jenkins.security.RekeySecretAdminMonitor/backups, and delete it if present.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-1000362?
CVE-2017-1000362 has been classified as a high-severity vulnerability due to the exposure of sensitive information.
How do I fix CVE-2017-1000362?
To fix CVE-2017-1000362, upgrade Jenkins to version 1.499 or later.
What impact does CVE-2017-1000362 have on Jenkins installations?
CVE-2017-1000362 allows unauthorized users to access sensitive backup data, compromising the security of Jenkins installations.
Which versions of Jenkins are affected by CVE-2017-1000362?
CVE-2017-1000362 affects all versions of Jenkins up to and including 1.498.
Is there a workaround for CVE-2017-1000362?
There is no recommended workaround for CVE-2017-1000362; updating Jenkins to a secure version is essential.