CVE-2021-21615: Race Condition

Q: What is CVE-2021-21615?

CVE-2021-21615 is a vulnerability in Jenkins that allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use (TOCTOU) race condition.

Q: What is the severity of CVE-2021-21615?

CVE-2021-21615 has a severity rating of 5.3 (medium).

Q: How can I fix CVE-2021-21615?

To fix CVE-2021-21615, upgrade Jenkins to version 2.276 or Jenkins LTS to version 2.263.3.

Q: Where can I find more information about CVE-2021-21615?

You can find more information about CVE-2021-21615 on the CVE website, NIST NVD, and the Jenkins security advisory.

Q: What are the CWE(s) associated with CVE-2021-21615?

The CWE(s) associated with CVE-2021-21615 are CWE-362, CWE-22, and CWE-367.

Published Jan 26, 2021

Updated

Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use (TOCTOU) race condition.

Affected Software

12 affected componentsFixes available

redhat/conmon<2:2.0.21-1.rhaos4.5.el8

2:2.0.21-1.rhaos4.5.el8

redhat/jenkins<0:2.263.3.1612434332-1.el7

0:2.263.3.1612434332-1.el7

redhat/machine-config-daemon<0:4.5.0-202102050524.p0.git.2594.ff3b8c0.el8

0:4.5.0-202102050524.p0.git.2594.ff3b8c0.el8

redhat/openshift<0:4.5.0-202102050524.p0.git.0.9229406.el8

0:4.5.0-202102050524.p0.git.0.9229406.el8

redhat/openshift-ansible<0:4.5.0-202102031005.p0.git.0.c6839a2.el7

0:4.5.0-202102031005.p0.git.0.c6839a2.el7

redhat/openshift-clients<0:4.5.0-202102051529.p0.git.3612.61b096a.el7

0:4.5.0-202102051529.p0.git.3612.61b096a.el7

redhat/runc<0:1.0.0-72.rhaos4.5.giteadfc6b.el8

0:1.0.0-72.rhaos4.5.giteadfc6b.el8

redhat/jenkins<0:2.263.3.1612434510-1.el8

0:2.263.3.1612434510-1.el8

redhat/jenkins<2.276

2.276

redhat/jenkins LTS<2.263.3

2.263.3

Jenkins Jenkins<2.263.3

Jenkins Jenkins<2.276

Event History

Jan 26, 2021

CVE Published

12:00 AM

CVE Published

via MITRE·10:55 AM

Data Sourced

via MITRE·10:55 AM

Description

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is CVE-2021-21615?

CVE-2021-21615 is a vulnerability in Jenkins that allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use (TOCTOU) race condition.

What is the severity of CVE-2021-21615?