CVEvulnerability
CVE-2019-1003049
8.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-04-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-613
Description
Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, because the fix for CVE-2019-1003004 in these releases did not reject existing remoting-based CLI authentication caches.
Affected configurations
• jenkins jenkins (<= 2.164.1)
• jenkins jenkins (<= 2.171)
• redhat openshift container platform 3.11
• oracle communications cloud native core automated test suite 1.9.0
Related
Weakness · not in database (1)
References
- http://www.securityfocus.com/bid/107901 Broken Link
- https://access.redhat.com/errata/RHBA-2019:1605 Third Party Advisory
- https://jenkins.io/security/advisory/2019-04-10/#SECURITY-1289 Vendor Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Third Party Advisory
- http://www.securityfocus.com/bid/107901 Broken Link
- https://access.redhat.com/errata/RHBA-2019:1605 Third Party Advisory
- https://jenkins.io/security/advisory/2019-04-10/#SECURITY-1289 Vendor Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Third Party Advisory