CVE-2021-21602: Medium severity Jenkins Jenkins vulnerability

Q: What is the severity of CVE-2021-21602?

CVE-2021-21602 is rated as a medium severity vulnerability in Jenkins.

Q: How do I fix CVE-2021-21602?

To fix CVE-2021-21602, upgrade Jenkins to version 2.275 or later, or LTS version 2.263.2 or later.

Q: What versions of Jenkins are affected by CVE-2021-21602?

Jenkins versions 2.274 and earlier, including LTS versions 2.263.1 and earlier, are affected by CVE-2021-21602.

Q: What types of files can be accessed due to CVE-2021-21602?

CVE-2021-21602 allows attackers to read arbitrary files through the file browser for workspaces and archived artifacts.

Q: Does CVE-2021-21602 affect plugins in Jenkins?

CVE-2021-21602 specifically affects the core Jenkins application rather than individual plugins.

Published Jan 13, 2021

Updated

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows reading arbitrary files using the file browser for workspaces and archived artifacts by following symlinks.

Other sources

The file browser for workspaces, archived artifacts, and $JENKINSHOME/userContent/ follows symbolic links to locations outside the directory being browsed in Jenkins 2.274 and earlier, LTS 2.263.1 and earlier.

This allows attackers with Job/Workspace permission and the ability to control workspace contents (e.g., with Job/Configure permission or the ability to change SCM contents) to create symbolic links that allow them to access files outside workspaces using the workspace browser.

This issue is caused by an incomplete fix for SECURITY-904 / CVE-2018-1000862 in the 2018-12-08 security advisory.

Jenkins 2.275, LTS 2.263.2 no longer supports symlinks in workspace browsers. While they may still exist on the file system, they are no longer shown on the UI, accessible via URLs, or included in directory content downloads.

This fix only changes the behavior of the Jenkins UI. Archiving artifacts still behaves as before.

Affected Software

15 affected componentsFixes available

redhat/jenkins<0:2.263.3.1612433584-1.el7

0:2.263.3.1612433584-1.el7

redhat/conmon<2:2.0.21-1.rhaos4.5.el7

2:2.0.21-1.rhaos4.5.el7

redhat/jenkins<0:2.263.3.1612434332-1.el7

0:2.263.3.1612434332-1.el7

redhat/machine-config-daemon<0:4.5.0-202102050524.p0.git.2594.ff3b8c0.el8

0:4.5.0-202102050524.p0.git.2594.ff3b8c0.el8

redhat/openshift<0:4.5.0-202102050524.p0.git.0.9229406.el7

0:4.5.0-202102050524.p0.git.0.9229406.el7

redhat/openshift-ansible<0:4.5.0-202102031005.p0.git.0.c6839a2.el7

0:4.5.0-202102031005.p0.git.0.c6839a2.el7

redhat/openshift-clients<0:4.5.0-202102051529.p0.git.3612.61b096a.el8

0:4.5.0-202102051529.p0.git.3612.61b096a.el8

redhat/runc<0:1.0.0-72.rhaos4.5.giteadfc6b.el8

0:1.0.0-72.rhaos4.5.giteadfc6b.el8

redhat/jenkins<0:2.263.3.1612434510-1.el8

0:2.263.3.1612434510-1.el8

maven/org.jenkins-ci.main:jenkins-core>=2.264<=2.274

2.275

maven/org.jenkins-ci.main:jenkins-core<=2.263.1

2.263.2

redhat/jenkins<2.275

2.275

redhat/jenkins LTS<2.263.2

2.263.2

Jenkins Jenkins<=2.263.1

Jenkins Jenkins<=2.274

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/jenkins to a version that resolves this vulnerability.
Fixed in 0:2.263.3.1612433584-1.el7
Upgrade
Upgrade redhat/conmon to a version that resolves this vulnerability.
Fixed in 2:2.0.21-1.rhaos4.5.el7
Upgrade
Upgrade redhat/jenkins to a version that resolves this vulnerability.
Fixed in 0:2.263.3.1612434332-1.el7
Upgrade
Upgrade redhat/machine-config-daemon to a version that resolves this vulnerability.
Fixed in 0:4.5.0-202102050524.p0.git.2594.ff3b8c0.el8
Upgrade
Upgrade redhat/openshift to a version that resolves this vulnerability.
Fixed in 0:4.5.0-202102050524.p0.git.0.9229406.el7
Upgrade
Upgrade redhat/openshift-ansible to a version that resolves this vulnerability.
Fixed in 0:4.5.0-202102031005.p0.git.0.c6839a2.el7
Upgrade
Upgrade redhat/openshift-clients to a version that resolves this vulnerability.
Fixed in 0:4.5.0-202102051529.p0.git.3612.61b096a.el8
Upgrade
Upgrade redhat/runc to a version that resolves this vulnerability.
Fixed in 0:1.0.0-72.rhaos4.5.giteadfc6b.el8
Upgrade
Upgrade redhat/jenkins to a version that resolves this vulnerability.
Fixed in 0:2.263.3.1612434510-1.el8
Upgrade
Upgrade maven/org.jenkins-ci.main:jenkins-core to a version that resolves this vulnerability.
Fixed in 2.275
Upgrade
Upgrade maven/org.jenkins-ci.main:jenkins-core to a version that resolves this vulnerability.
Fixed in 2.263.2
Upgrade
Upgrade redhat/jenkins to a version that resolves this vulnerability.
Fixed in 2.275
Upgrade
Upgrade redhat/jenkins LTS to a version that resolves this vulnerability.
Fixed in 2.263.2
Upgrade
Upgrade Jenkins to a version that resolves this vulnerability.
Fixed in 2.275
Upgrade
Upgrade Jenkins LTS to a version that resolves this vulnerability.
Fixed in 2.263.2
Configuration
After upgrading, Jenkins no longer supports symlinks in the file browser for workspaces, archived artifacts, and $JENKINS_HOME/userContent/, so symlinks are not followed to locations outside the directory being browsed.
Jenkins UI file browser (workspaces and archived artifacts) symlink handling = disable symlinks in workspace browsers

Event History

Jan 13, 2021

CVE Published

12:00 AM

CVE Published

via MITRE·03:55 PM

Data Sourced

via MITRE·03:55 PM

Description

Feb 4, 2021

Data Sourced

via Red Hat·02:01 PM

DescriptionSeverityAffected Software

May 24, 2022

Advisory Published

05:39 PM

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is the severity of CVE-2021-21602?