CVE-2019-1003049
First published: Wed Apr 10 2019(Updated: )
Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, because the fix for CVE-2019-1003004 in these releases did not reject existing remoting-based CLI authentication caches.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Jenkins | <=2.164.1 | |
| Jenkins Jenkins | <=2.171 | |
| redhat openshift container platform | =3.11 | |
| oracle communications Cloud native core automated test suite | =1.9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-1003049?
CVE-2019-1003049 is a vulnerability that allows users who cached their CLI authentication before Jenkins was updated to remain authenticated in certain versions of Jenkins.
Which versions of Jenkins are affected by CVE-2019-1003049?
Jenkins versions 2.164.1 and earlier, as well as Jenkins LTS 2.164.1 and earlier, are affected by CVE-2019-1003049.
What is the severity of CVE-2019-1003049?
CVE-2019-1003049 has a severity rating of 8.1 (high).
How can I fix CVE-2019-1003049?
To fix CVE-2019-1003049, users should update Jenkins to version 2.150.2 or newer, or version 2.160 or newer.
Where can I find more information about CVE-2019-1003049?
More information about CVE-2019-1003049 can be found at the following references: http://www.securityfocus.com/bid/107901, https://access.redhat.com/errata/RHBA-2019:1605, https://jenkins.io/security/advisory/2019-04-10/#SECURITY-1289
- agent/references
- agent/author
- agent/type
- agent/remedy
- agent/weakness
- agent/severity
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/first-publish-date
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-api
- vendor/jenkins
- canonical/jenkins jenkins
- version/jenkins jenkins/2.164.1
- version/jenkins jenkins/2.171
- vendor/redhat
- canonical/redhat openshift container platform
- version/redhat openshift container platform/3.11
- vendor/oracle
- canonical/oracle communications cloud native core automated test suite
- version/oracle communications cloud native core automated test suite/1.9.0