Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2017.3200
Jenkins patches race conditions during setup
14 December 2017
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Jenkins
Publisher: Jenkins
Operating System: Windows
UNIX variants (UNIX, Linux, OSX)
Impact/Access: Cross-site Request Forgery -- Remote with User Interaction
Unauthorised Access -- Remote/Unauthenticated
Resolution: Patch/Upgrade
Original Bulletin:
https://jenkins.io/security/advisory/2017-12-14/
Comment: Please note that the bugs are triggered during setup.
The vendor advises:
"Affected instances need to be configured to restrict access."
- --------------------------BEGIN INCLUDED TEXT--------------------
Jenkins Security Advisory 2017-12-14
This advisory announces two vulnerabilities in Jenkins.
Description
Random failures to initialize the setup wizard on startup
SECURITY-667
A race condition during Jenkins startup could result in the wrong order
of execution of commands during initialization.
On Jenkins 2.81 and newer, including LTS 2.89.1, this could in rare cases
(we estimate less than 20% of new instances) result in failure to initialize
the setup wizard on the first startup. This resulted in the following security
settings not being set to their usual strict default:
No security realm was defined, and no admin user was created whose password
was written to the Jenkins log or the initialAdminPassword file.
The authorization strategy remained Anyone can do anything rather than
Logged-in users can do anything.
TCP port for JNLP agents, usually disabled by default, was open, unless a
Java system property controlling it was set.
CLI over Remoting was enabled.
CSRF Protection was disabled.
Agent → Master Access Control was disabled.
Affected instances need to be configured to restrict access.
CSRF protection delayed after startup
SECURITY-667
A race condition during Jenkins startup could result in the wrong order of
execution of commands during initialization.
There’s a very short window of time after startup during which Jenkins may
no longer show the "Please wait while Jenkins is getting ready to work" message,
but Cross-Site Request Forgery (CSRF) protection may not yet be effective.
As of publication of this advisory, we’ve been unable to confirm this can
actually be exploited, but generally recommend that users upgrade to the
fixed versions below.
Severity
SECURITY-667: high
Affected versions
Random failures to initialize the setup wizard on startup:
Jenkins 2.81 through 2.94 (inclusive)
Jenkins LTS 2.89.1
CSRF protection delayed after startup:
Jenkins up to and including 2.94
Jenkins LTS up to and including 2.89.1
Fix
Jenkins main line users should update to 2.95
Jenkins LTS users should update to 2.89.2
Users who originally installed Jenkins 2.81 through 2.94, or LTS 2.89.1,
should review all the options of the Configure Global Security screen.
These versions include fixes to all the vulnerabilities described above.
All prior versions are affected by these vulnerabilities unless
otherwise indicated.
Credit
The Jenkins project would like to thank the reporters for discovering and
reporting these vulnerabilities:
Daniel Beck, CloudBees, Inc. for SECURITY-667
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWjIZiIx+lLeg9Ub1AQhZ7w/+PScz9qVmE+G1B756liHIOl9dcA7PogZX
5lfuXRIdb3/yRBusQlYT9InSxGtfkRIFGmAU4hClAEOISa5iZ7UHwLHCh2qPKc1D
szrneTH/XCS25dD1TYakJ4zQFCw3++S/Joodp1EY5QMKRdJQj/o6G+x/QuoHUVwh
KJQqmqokCYgj4bI0HUyUY0ki65g+SC2YCXJzfi7SNdvXdKDt3CWtK1Tkzgq70H+u
u7hbjT3dagQ0391oyXqLKE7anhG0j8TLpb+MLjr2ZppU3iCaxE4u5Vs0WqhJo8tT
J6kQ5SnjzcfRxpUA0XM2zUdeaUVTi3EJ7skDliSSjhTEuYb4VUTcUQZucVc02J2g
pAaTgRW1AGvXEQrPpjmYJOF3EPZZtHgKTeLJzNarReKNhrKqASYjV1vk5Lp4RouC
+E6Se3xquhKjWNM6E27+RkU6t/rcv6W+7yWQEZHG68r7aAA5CKijkLhCPXur4QFx
v1L8ikYMxE2XJBSfGjppfbaY9kR/5fR1U2du7meqt4EMLAPBiKQOaQudkeufrPfU
plO59Ee/7qTyRPhaC6f46tDkeHjrU7Ry6GgPJsKNF3HDflG8hZj1lPF7YEzXGgL+
GJ6CILdRzAhiCSDFI5SduNdwJj/5VDjKhXS57KnM5fXnihwyQJOUncOG3k039x2F
fb9AccDiotI=
=63i+
-----END PGP SIGNATURE-----