[Bug 1446114] New: CVE-2017-1000353 jenkins: Unauthenticated remote code execution (SECURITY-429)
https://bugzilla.redhat.com/show_bug.cgi?id=1446114
Bug ID: 1446114 Summary: CVE-2017-1000353 jenkins: Unauthenticated remote code execution (SECURITY-429) Product: Security Response Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team@redhat.com Reporter: amaris@redhat.com CC: abhgupta@redhat.com, bleanhar@redhat.com, ccoleman@redhat.com, dedgar@redhat.com, dmcphers@redhat.com, java-sig-commits@lists.fedoraproject.org, jgoulding@redhat.com, jkeck@redhat.com, joelsmith@redhat.com, kseifried@redhat.com, mizdebsk@redhat.com, msrb@redhat.com, tdawson@redhat.com, tiwillia@redhat.com
An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java SignedObject object to the remoting-based Jenkins CLI, that would be deserialized using a new ObjectInputStream, bypassing the existing blacklist-based protection mechanism.
SignedObject has been added to the remoting blacklist.
In Jenkins 2.54, the remoting-based CLI protocol was deprecated and a new, HTTP based protocol introduced as the new default, in addition to the existing SSH-based CLI. This feature has been backported to Jenkins 2.46.2. It is strongly recommended that users upgrading Jenkins disable the remoting-based CLI, and use the one of the other modes (HTTP or SSH) instead.
Affected versions:
All Jenkins main line releases up to and including 2.56 All Jenkins LTS releases up to and including 2.46.1
Fixed in:
Jenkins main line users should update to 2.57 Jenkins LTS users should update to 2.46.2
External Reference:
https://jenkins.io/security/advisory/2017-04-26/
https://bugzilla.redhat.com/show_bug.cgi?id=1446114
Adam Mariš amaris@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version| |jenkins 2.46.2, jenkins | |2.57
https://bugzilla.redhat.com/show_bug.cgi?id=1446114
--- Comment #1 from Adam Mariš amaris@redhat.com --- Acknowledgments:
Name: the Jenkins project
https://bugzilla.redhat.com/show_bug.cgi?id=1446114
Adam Mariš amaris@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1446134, 1446133
--- Comment #2 from Adam Mariš amaris@redhat.com --- Created jenkins tracking bugs for this issue:
Affects: fedora-all [bug 1446133] Affects: openshift-1 [bug 1446134]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1446133 [Bug 1446133] CVE-2017-1000353 CVE-2017-1000354 CVE-2017-1000355 CVE-2017-1000356 jenkins: various flaws [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1446114
Adam Mariš amaris@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1446135
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |jshepherd@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1446114
Kurt Seifried kseifried@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1395176
https://bugzilla.redhat.com/show_bug.cgi?id=1446114
Min Woo Park mpark@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |mpark@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1446114
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |ahardin@redhat.com, | |dbaker@redhat.com, | |jokerman@redhat.com, | |mchappel@redhat.com Whiteboard|impact=important,public=201 |impact=important,public=201 |70426,reported=20170419,sou |70426,reported=20170419,sou |rce=distros,cvss3=8.1/CVSS: |rce=distros,cvss3=8.1/CVSS: |3.0/AV:N/AC:H/PR:N/UI:N/S:U |3.0/AV:N/AC:H/PR:N/UI:N/S:U |/C:H/I:H/A:H,cwe=CWE-502,op |/C:H/I:H/A:H,cwe=CWE-502,op |enshift-enterprise-3/jenkin |enshift-enterprise-3/jenkin |s=new,openshift-enterprise- |s=notaffected,openshift-ent |2/jenkins=new,openshift-1/j |erprise-2/jenkins=wontfix,o |enkins=affected,fedora-all/ |penshift-1/jenkins=affected |jenkins=affected |,fedora-all/jenkins=affecte | |d
--- Comment #4 from Jason Shepherd jshepherd@redhat.com --- Openshift 2 is EOL: https://access.redhat.com/support/policy/updates/openshift
Fixed in Openshift 3.7, currently Jenkins latest is pointing to 3.10, see https://github.com/openshift/jenkins/blob/master/2/release.version
https://bugzilla.redhat.com/show_bug.cgi?id=1446114
--- Comment #5 from Jason Shepherd jshepherd@redhat.com --- To expand on the last comment. The rpm jenkins-2.46.3-1.el7.noarch included in this image, [1] was released after 2.46.2, and would be considered a newer release then Jenkins LTS 2.46.1
From, https://jenkins.io/doc/book/managing/cli/
"Use of the CLI client distributed with Jenkins 2.53 and older and Jenkins LTS 2.46.1 and older is not recommended for security reasons: while there are no currently known vulnerabilities, several have been reported and patched in the past, and the Jenkins Remoting protocol it uses is inherently vulnerable to remote code execution bugs, even “preauthentication” exploits (by anonymous users able to physically access the Jenkins network)."
I would consider CVE-2017-1000353 a "known vulnerability" by the definition in this paragraph.
[1] https://access.redhat.com/containers/?tab=security#/registry.access.redhat.c...
https://bugzilla.redhat.com/show_bug.cgi?id=1446114
--- Comment #6 from Jason Shepherd jshepherd@redhat.com --- I used the test case here to verify this is fixed in Jenkins image with tag v3.6.173.0.96-11.
https://blogs.securiteam.com/index.php/archives/3171
Also uploading the test case to srtvulns/compoments/openshift/CVE-2017-1000353
java-sig-commits@lists.fedoraproject.org
-
bugzilla＠redhat.com