CVE-2020-2099: High severity Jenkins Jenkins vulnerability
Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents, which can be used to connect to Jenkins, impersonating those agents.
Other sources
Jenkins 2.213 and earlier, LTS 2.204.1 and earlier includes support for the Inbound TCP Agent Protocol/3 for communication between controller and agents. While this protocol has been deprecated in 2018 and was recently removed from Jenkins in 2.214, it could still easily be enabled in Jenkins LTS 2.204.1, 2.213, and older.
This protocol incorrectly reuses encryption parameters which allow an unauthenticated remote attacker to determine the connection secret. This secret can then be used to connect attacker-controlled Jenkins agents to the Jenkins controller.
Jenkins 2.204.2 no longer allows for the use of Inbound TCP Agent Protocol/3 by default. The system property jenkins.slaves.JnlpSlaveAgentProtocol3.ALLOWUNSAFE can be set to true to allow enabling the Inbound TCP Agent Protocol/3 in Jenkins 2.204.2, but doing so is strongly discouraged.
Inbound TCP Agent Protocol/3 was removed completely from Jenkins 2.214 and will not be part of Jenkins LTS after the end of the 2.204.x line.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.jenkins-ci.main:jenkins-coreto a version that resolves this vulnerability.Fixed in 2.214 - Upgrade
Upgrade
maven/org.jenkins-ci.main:jenkins-coreto a version that resolves this vulnerability.Fixed in 2.204.2 - Upgrade
Upgrade
jenkinsto a version that resolves this vulnerability.Fixed in 2.214 - Configuration
Ensure the system property jenkins.slaves.JnlpSlaveAgentProtocol3.ALLOW_UNSAFE is not set to true (i.e., keep it false/unset) so Inbound TCP Agent Protocol/3 cannot be enabled in Jenkins 2.204.2, 2.204.1, 2.213 and earlier.
Jenkins jenkins.slaves.JnlpSlaveAgentProtocol3.ALLOW_UNSAFE = false
Event History
Frequently Asked Questions
What is the severity of CVE-2020-2099?
CVE-2020-2099 is classified as a medium severity vulnerability.
How do I fix CVE-2020-2099?
To fix CVE-2020-2099, upgrade to Jenkins version 2.214 or 2.204.2 or later.
What are the affected versions in CVE-2020-2099?
CVE-2020-2099 affects Jenkins versions 2.213 and earlier, and LTS versions up to 2.204.1.
What type of vulnerability is CVE-2020-2099?
CVE-2020-2099 is an improper key management vulnerability impacting Jenkins.
Who can exploit CVE-2020-2099?
CVE-2020-2099 can be exploited by unauthorized attackers who have knowledge of Jenkins agent names.