Lucene search
GoogleOSV:GHSA-742J-JCFR-23W3HistoryMay 13, 2022 - 1:01 a.m.
Insufficient Session Expiration in Jenkins
2022-05-1301:01:01
Google
osv.dev
10
0.003 Low
EPSS
Percentile
68.0%
Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, because the fix for CVE-2019-1003004 in these releases did not reject existing remoting-based CLI authentication caches.
References
www.securityfocus.com/bid/107901
access.redhat.com/errata/RHBA-2019:1605
github.com/jenkinsci/jenkins
github.com/jenkinsci/jenkins/commit/0eeaa087aac192fb39f52928be5a5bbf16627ea6
jenkins.io/security/advisory/2019-04-10/#SECURITY-1289
nvd.nist.gov/vuln/detail/CVE-2019-1003049
www.oracle.com/security-alerts/cpuapr2022.html
Related
cvelist
cvelist
CVE-2019-1003049
2019-04-10 20:12:29
CVE-2019-1003004
2019-01-22 14:00:00
prion
prion
Authentication flaw
2019-04-10 21:29:00
Authorization
2019-01-22 14:29:00
osv
osv
CVE-2019-1003049
2019-04-10 21:29:01
CVE-2019-1003004
2019-01-22 14:29:00
Improper Authorization in Jenkins Core
2022-05-13 01:05:22
alpinelinux
alpinelinux
CVE-2019-1003049
2019-04-10 21:29:01
redhatcve
redhatcve
CVE-2019-1003049
2019-04-15 03:50:05
CVE-2019-1003004
2020-04-09 10:33:33
nvd
nvd
CVE-2019-1003049
2019-04-10 21:29:01
CVE-2019-1003004
2019-01-22 14:29:00
github
github
Insufficient Session Expiration in Jenkins
2022-05-13 01:01:01
Improper Authorization in Jenkins Core
2022-05-13 01:05:22
cve
cve
CVE-2019-1003049
2019-04-10 21:29:01
CVE-2019-1003004
2019-01-22 14:29:00
openvas
openvas
Jenkins < 2.164.2 LTS and < 2.172 Multiple Vulnerabilities - Linux
2019-04-17 00:00:00
Jenkins < 2.164.2 LTS and < 2.172 Multiple Vulnerabilities - Windows
2019-04-17 00:00:00
Jenkins < 2.160 and < 2.150.2 LTS Multiple Vulnerabilities - Windows
2019-01-23 00:00:00
veracode
veracode
Weak Authentication
2019-07-08 00:06:43
Insecure Session Management
2019-05-16 03:24:12
archlinux
archlinux
[ASA-201904-7] jenkins: multiple issues
2019-04-11 00:00:00
nessus
nessus
Jenkins < 2.164.2 LTS / 2.172 Multiple Vulnerabilities
2019-04-18 00:00:00
Jenkins < 2.150.2 LTS / 2.160 Multiple Vulnerabilities
2019-01-23 00:00:00
oracle
oracle
Oracle Critical Patch Update Advisory - April 2022
2022-04-19 00:00:00