CVE-2021-21671: High severity Jenkins Jenkins vulnerability

Q: What is CVE-2021-21671?

CVE-2021-21671 is a vulnerability in Jenkins 2.299 and earlier LTS 2.289.1 and earlier.

Q: How does CVE-2021-21671 allow attackers to gain access to Jenkins?

CVE-2021-21671 allows attackers to use social engineering techniques to gain administrator access to Jenkins.

Q: What is the severity of CVE-2021-21671?

The severity of CVE-2021-21671 is high, with a severity value of 7.5.

Q: Which versions of Jenkins are affected by CVE-2021-21671?

Jenkins 2.299 and earlier, LTS 2.289.1 and earlier are affected by CVE-2021-21671.

Q: How do I fix CVE-2021-21671?

To fix CVE-2021-21671, update to Jenkins 2.300 or LTS 2.289.2 or later.

Published Jun 30, 2021

Updated

Jenkins 2.299 and earlier, LTS 2.289.1 and earlier does not invalidate the previous session on login.

Other sources

Session fixation vulnerability was found in Jenkins. The existing session on login process are not invalidated and this allows an attacker to gain potentially additional access on Jenkins by using social engineering attack techniques on a target user.

Affected Software

9 affected componentsFixes available

redhat/jenkins<0:2.289.2.1629437819-1.el8

0:2.289.2.1629437819-1.el8

redhat/jenkins<0:2.289.2.1628252553-1.el8

0:2.289.2.1628252553-1.el8

redhat/jenkins<0:2.289.3.1633554819-1.el8

0:2.289.3.1633554819-1.el8

maven/org.jenkins-ci.main:jenkins-core<=2.289.1

2.289.2

maven/org.jenkins-ci.main:jenkins-core>=2.292<=2.299

2.300

redhat/jenkins LTS<2.289.2

2.289.2

redhat/jenkins<2.300

2.300

Jenkins Jenkins>=2.266<2.300

Jenkins Jenkins>=2.277.1<2.289.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/jenkins to a version that resolves this vulnerability.
Fixed in 0:2.289.2.1629437819-1.el8
Upgrade
Upgrade redhat/jenkins to a version that resolves this vulnerability.
Fixed in 0:2.289.2.1628252553-1.el8
Upgrade
Upgrade redhat/jenkins to a version that resolves this vulnerability.
Fixed in 0:2.289.3.1633554819-1.el8
Upgrade
Upgrade maven/org.jenkins-ci.main:jenkins-core to a version that resolves this vulnerability.
Fixed in 2.289.2
Upgrade
Upgrade maven/org.jenkins-ci.main:jenkins-core to a version that resolves this vulnerability.
Fixed in 2.300
Upgrade
Upgrade redhat/jenkins LTS to a version that resolves this vulnerability.
Fixed in 2.289.2
Upgrade
Upgrade redhat/jenkins to a version that resolves this vulnerability.
Fixed in 2.300
Upgrade
Upgrade Jenkins to a version that resolves this vulnerability.
Fixed in 2.300
Upgrade
Upgrade Jenkins (LTS) to a version that resolves this vulnerability.
Fixed in 2.289.2
Configuration
Set hudson.security.SecurityRealm.sessionFixationProtectionMode to 2 to use the alternative session fixation protection implementation.
Jenkins Java system property hudson.security.SecurityRealm.sessionFixationProtectionMode = 2
Configuration
Set hudson.security.SecurityRealm.sessionFixationProtectionMode to 0 to disable the session fixation protection fix entirely.
Jenkins Java system property hudson.security.SecurityRealm.sessionFixationProtectionMode = 0

Event History

Jun 30, 2021

CVE Published

12:00 AM

CVE Published

via MITRE·04:45 PM

Data Sourced

via MITRE·04:45 PM

Description

Sep 24, 2021

Data Sourced

via Red Hat·06:24 PM

DescriptionSeverityAffected Software

May 24, 2022

Advisory Published

07:06 PM

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is CVE-2021-21671?