GitHub Advisoryadvisory · Maven

GHSA-r5x3-2446-hrp7 Race Condition in Jenkins

HIGH Published 2022-05-14 Modified 2024-03-04 Official page ↗
Aliases
CVE-2017-1000503
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-362
Reviewed
2022-07-01

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: >= 2.81, < 2.89.2 → fixed in 2.89.2 • Maven org.jenkins-ci.main:jenkins-core: >= 2.90, < 2.95 → fixed in 2.95

Description

A race condition during Jenkins 2.81 through 2.94 (inclusive); 2.89.1 startup could result in the wrong order of execution of commands during initialization. This could in rare cases result in failure to initialize the setup wizard on the first startup. This resulted in multiple security-related settings not being set to their usual strict default.

Related

Alias · CVE (1)

  • CVE-2017-1000503 A race condition during Jenkins 2.81 through 2.94 (inclusive); 2.89.1 startup could result in the wrong order of execution of commands… vulnerability

Weakness · CWE (1)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References