Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents, which can be used to connect to Jenkins, impersonating those agents.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-2099US | high8.6OT elevated | — | ||
Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge o… | ||||
02
references
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2020/01/29/1ADVISORY
- https://access.redhat.com/errata/RHBA-2020:0402WEB
- https://access.redhat.com/errata/RHBA-2020:0675WEB
- https://access.redhat.com/errata/RHSA-2020:0681WEB
- https://access.redhat.com/errata/RHSA-2020:0683WEB
- https://jenkins.io/security/advisory/2020-01-29/#SECURITY-1682ADVISORY
- https://nvd.nist.gov/vuln/detail/CVE-2020-2099WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan