CVE-2021-21609: Medium severity Jenkins Jenkins vulnerability

Q: What is the severity of CVE-2021-21609?

The severity of CVE-2021-21609 is medium with a severity value of 5.3.

Q: How does CVE-2021-21609 impact Jenkins?

CVE-2021-21609 allows attackers without Overall/Read permission to access certain URLs as if they had Overall/Read permission.

Q: Which versions of Jenkins are affected by CVE-2021-21609?

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier are affected by CVE-2021-21609.

Q: How can I fix CVE-2021-21609?

To fix CVE-2021-21609, update Jenkins to version 2.275 or later, or LTS 2.263.2 or later.

Q: Where can I find more information about CVE-2021-21609?

For more information about CVE-2021-21609, you can visit the CVE website (https://www.cve.org/CVERecord?id=CVE-2021-21609) or the NIST National Vulnerability Database (https://nvd.nist.gov/vuln/detail/CVE-2021-21609).

Published Jan 13, 2021

Updated

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly match requested URLs to the list of always accessible paths, allowing attackers without Overall/Read permission to access some URLs as if they did have Overall/Read permission.

Other sources

Jenkins includes a static list of URLs that are always accessible even without Overall/Read permission, such as the login form. These URLs are excluded from an otherwise universal permission check.

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly compare requested URLs with that list.

This allows attackers without Overall/Read permission to access plugin-provided URLs with any of the following prefixes if no other permissions are required: - accessDenied - error - instance-identity - login - logout - oops - securityRealm - signup - tcpSlaveAgentListener

For example, a plugin contributing the path loginFoo/ would have URLs in that space accessible without the default Overall/Read permission check.

The Jenkins security team is not aware of any affected plugins as of the publication of this advisory.

The comparison of requested URLs with the list of always accessible URLs has been fixed to only allow access to the specific listed URLs in Jenkins 2.275, LTS 2.263.2.

In case this change causes problems, additional paths can be made accessible without Overall/Read permissions: The Java system property jenkins.model.Jenkins.additionalReadablePaths is a comma-separated list of additional path prefixes to allow access to.

Affected Software

15 affected componentsFixes available

redhat/jenkins<0:2.263.3.1612433584-1.el7

0:2.263.3.1612433584-1.el7

redhat/conmon<2:2.0.21-1.rhaos4.5.el7

2:2.0.21-1.rhaos4.5.el7

redhat/jenkins<0:2.263.3.1612434332-1.el7

0:2.263.3.1612434332-1.el7

redhat/machine-config-daemon<0:4.5.0-202102050524.p0.git.2594.ff3b8c0.el8

0:4.5.0-202102050524.p0.git.2594.ff3b8c0.el8

redhat/openshift<0:4.5.0-202102050524.p0.git.0.9229406.el7

0:4.5.0-202102050524.p0.git.0.9229406.el7

redhat/openshift-ansible<0:4.5.0-202102031005.p0.git.0.c6839a2.el7

0:4.5.0-202102031005.p0.git.0.c6839a2.el7

redhat/openshift-clients<0:4.5.0-202102051529.p0.git.3612.61b096a.el8

0:4.5.0-202102051529.p0.git.3612.61b096a.el8

redhat/runc<0:1.0.0-72.rhaos4.5.giteadfc6b.el8

0:1.0.0-72.rhaos4.5.giteadfc6b.el8

redhat/jenkins<0:2.263.3.1612434510-1.el8

0:2.263.3.1612434510-1.el8

maven/org.jenkins-ci.main:jenkins-core>=2.264<=2.274

2.275

maven/org.jenkins-ci.main:jenkins-core<=2.263.1

2.263.2

redhat/jenkins<2.275

2.275

redhat/jenkins LTS<2.263.2

2.263.2

Jenkins Jenkins<=2.263.1

Jenkins Jenkins<=2.274

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/jenkins to a version that resolves this vulnerability.
Fixed in 0:2.263.3.1612433584-1.el7
Upgrade
Upgrade redhat/conmon to a version that resolves this vulnerability.
Fixed in 2:2.0.21-1.rhaos4.5.el7
Upgrade
Upgrade redhat/jenkins to a version that resolves this vulnerability.
Fixed in 0:2.263.3.1612434332-1.el7
Upgrade
Upgrade redhat/machine-config-daemon to a version that resolves this vulnerability.
Fixed in 0:4.5.0-202102050524.p0.git.2594.ff3b8c0.el8
Upgrade
Upgrade redhat/openshift to a version that resolves this vulnerability.
Fixed in 0:4.5.0-202102050524.p0.git.0.9229406.el7
Upgrade
Upgrade redhat/openshift-ansible to a version that resolves this vulnerability.
Fixed in 0:4.5.0-202102031005.p0.git.0.c6839a2.el7
Upgrade
Upgrade redhat/openshift-clients to a version that resolves this vulnerability.
Fixed in 0:4.5.0-202102051529.p0.git.3612.61b096a.el8
Upgrade
Upgrade redhat/runc to a version that resolves this vulnerability.
Fixed in 0:1.0.0-72.rhaos4.5.giteadfc6b.el8
Upgrade
Upgrade redhat/jenkins to a version that resolves this vulnerability.
Fixed in 0:2.263.3.1612434510-1.el8
Upgrade
Upgrade maven/org.jenkins-ci.main:jenkins-core to a version that resolves this vulnerability.
Fixed in 2.275
Upgrade
Upgrade maven/org.jenkins-ci.main:jenkins-core to a version that resolves this vulnerability.
Fixed in 2.263.2
Upgrade
Upgrade redhat/jenkins to a version that resolves this vulnerability.
Fixed in 2.275
Upgrade
Upgrade redhat/jenkins LTS to a version that resolves this vulnerability.
Fixed in 2.263.2
Upgrade
Upgrade Jenkins to a version that resolves this vulnerability.
Fixed in 2.275
Upgrade
Upgrade Jenkins to a version that resolves this vulnerability.
Fixed in 2.263.2

Event History

Jan 13, 2021

CVE Published

12:00 AM

CVE Published

via MITRE·03:55 PM

Data Sourced

via MITRE·03:55 PM

Description

Feb 4, 2021

Data Sourced

via Red Hat·01:43 PM

DescriptionSeverityAffected Software

May 24, 2022

Advisory Published

05:39 PM

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is the severity of CVE-2021-21609?