CVE-2021-21605: Input Validation

Q: What is the severity of CVE-2021-21605?

CVE-2021-21605 has a high severity level, impacting data confidentiality, integrity, and system availability.

Q: How do I fix CVE-2021-21605?

To remediate CVE-2021-21605, upgrade to Jenkins version 2.275 or LTS version 2.263.2.

Q: Who is affected by CVE-2021-21605?

CVE-2021-21605 affects Jenkins versions 2.274 and earlier, as well as all LTS versions prior to 2.263.2.

Q: What impacts can CVE-2021-21605 have on my system?

CVE-2021-21605 can lead to unauthorized access and manipulation of the global config.xml file, compromising data security.

Q: How can I identify if my Jenkins installation is vulnerable to CVE-2021-21605?

You can determine if your Jenkins installation is vulnerable by checking its version against the affected versions listed in CVE-2021-21605.

Published Jan 13, 2021

Updated

A flaw was found in jenkins. Users with Agent/Configure permissions can choose agent names that cause an override to the global config.xml file. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Other sources

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows users with Agent/Configure permission to choose agent names that cause Jenkins to override the global config.xml file.

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows users with Agent/Configure permission to choose agent names that cause Jenkins to override unrelated config.xml files. If the global config.xml file is replaced, Jenkins will start up with unsafe legacy defaults after a restart.

Jenkins 2.275, LTS 2.263.2 ensures that agent names are considered valid names for items to prevent this problem.

In case of problems, this change can be reverted by setting the Java system property jenkins.model.Nodes.enforceNameRestrictions to false.

Affected Software

15 affected componentsFixes available

redhat/jenkins<0:2.263.3.1612433584-1.el7

0:2.263.3.1612433584-1.el7

redhat/conmon<2:2.0.21-1.rhaos4.5.el7

2:2.0.21-1.rhaos4.5.el7

redhat/jenkins<0:2.263.3.1612434332-1.el7

0:2.263.3.1612434332-1.el7

redhat/machine-config-daemon<0:4.5.0-202102050524.p0.git.2594.ff3b8c0.el8

0:4.5.0-202102050524.p0.git.2594.ff3b8c0.el8

redhat/openshift<0:4.5.0-202102050524.p0.git.0.9229406.el7

0:4.5.0-202102050524.p0.git.0.9229406.el7

redhat/openshift-ansible<0:4.5.0-202102031005.p0.git.0.c6839a2.el7

0:4.5.0-202102031005.p0.git.0.c6839a2.el7

redhat/openshift-clients<0:4.5.0-202102051529.p0.git.3612.61b096a.el8

0:4.5.0-202102051529.p0.git.3612.61b096a.el8

redhat/runc<0:1.0.0-72.rhaos4.5.giteadfc6b.el8

0:1.0.0-72.rhaos4.5.giteadfc6b.el8

redhat/jenkins<0:2.263.3.1612434510-1.el8

0:2.263.3.1612434510-1.el8

maven/org.jenkins-ci.main:jenkins-core>=2.264<2.275

2.275

maven/org.jenkins-ci.main:jenkins-core<2.263.2

2.263.2

redhat/jenkins<2.275

2.275

redhat/jenkins LTS<2.263.2

2.263.2

Jenkins Jenkins<=2.263.1

Jenkins Jenkins<=2.274

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/jenkins to a version that resolves this vulnerability.
Fixed in 0:2.263.3.1612433584-1.el7
Upgrade
Upgrade redhat/conmon to a version that resolves this vulnerability.
Fixed in 2:2.0.21-1.rhaos4.5.el7
Upgrade
Upgrade redhat/jenkins to a version that resolves this vulnerability.
Fixed in 0:2.263.3.1612434332-1.el7
Upgrade
Upgrade redhat/machine-config-daemon to a version that resolves this vulnerability.
Fixed in 0:4.5.0-202102050524.p0.git.2594.ff3b8c0.el8
Upgrade
Upgrade redhat/openshift to a version that resolves this vulnerability.
Fixed in 0:4.5.0-202102050524.p0.git.0.9229406.el7
Upgrade
Upgrade redhat/openshift-ansible to a version that resolves this vulnerability.
Fixed in 0:4.5.0-202102031005.p0.git.0.c6839a2.el7
Upgrade
Upgrade redhat/openshift-clients to a version that resolves this vulnerability.
Fixed in 0:4.5.0-202102051529.p0.git.3612.61b096a.el8
Upgrade
Upgrade redhat/runc to a version that resolves this vulnerability.
Fixed in 0:1.0.0-72.rhaos4.5.giteadfc6b.el8
Upgrade
Upgrade redhat/jenkins to a version that resolves this vulnerability.
Fixed in 0:2.263.3.1612434510-1.el8
Upgrade
Upgrade maven/org.jenkins-ci.main:jenkins-core to a version that resolves this vulnerability.
Fixed in 2.275
Upgrade
Upgrade maven/org.jenkins-ci.main:jenkins-core to a version that resolves this vulnerability.
Fixed in 2.263.2
Upgrade
Upgrade redhat/jenkins to a version that resolves this vulnerability.
Fixed in 2.275
Upgrade
Upgrade redhat/jenkins LTS to a version that resolves this vulnerability.
Fixed in 2.263.2
Upgrade
Upgrade Jenkins to a version that resolves this vulnerability.
Fixed in 2.275
Upgrade
Upgrade Jenkins (LTS) to a version that resolves this vulnerability.
Fixed in 2.263.2
Configuration
If problems occur after replacing the global config.xml file, revert the change by setting the Java system property jenkins.model.Nodes.enforceNameRestrictions to false.
Jenkins jenkins.model.Nodes.enforceNameRestrictions = false
Compensating control
Limit users with Agent/Configure permissions so they cannot choose agent names that override the global config.xml file (data confidentiality/integrity and availability impact).

Event History

Jan 13, 2021

CVE Published

12:00 AM

CVE Published

via MITRE·03:55 PM

Data Sourced

via MITRE·03:55 PM

Description

Feb 4, 2021

Data Sourced

via Red Hat·01:48 PM

DescriptionSeverityAffected Software

May 24, 2022

Advisory Published

05:39 PM

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is the severity of CVE-2021-21605?