GitHub Advisoryadvisory · Maven

GHSA-742j-jcfr-23w3 Insufficient Session Expiration in Jenkins

HIGH Published 2022-05-13 Modified 2022-06-29 Official page ↗
Aliases
CVE-2019-1003049
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-613
Reviewed
2022-06-29

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: < 2.164.2 → fixed in 2.164.2 • Maven org.jenkins-ci.main:jenkins-core: >= 2.165, < 2.172 → fixed in 2.172

Description

Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, because the fix for CVE-2019-1003004 in these releases did not reject existing remoting-based CLI authentication caches.

Related

Weakness · not in database (1)

Alias · CVE (1)

  • CVE-2019-1003049 Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated… vulnerability

References