{"containers": {"cna": {"affected": [{"product": "Jenkins", "vendor": "Jenkins project", "versions": [{"status": "affected", "version": "2.171 and earlier, LTS 2.164.1 and earlier"}]}], "descriptions": [{"lang": "en", "value": "Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, because the fix for CVE-2019-1003004 in these releases did not reject existing remoting-based CLI authentication caches."}], "providerMetadata": {"orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins", "dateUpdated": "2023-10-24T16:45:27.954Z"}, "references": [{"name": "107901", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/107901"}, {"name": "RHBA-2019:1605", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHBA-2019:1605"}, {"tags": ["x_refsource_MISC"], "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://jenkins.io/security/advisory/2019-04-10/#SECURITY-1289"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "jenkinsci-cert@googlegroups.com", "ID": "CVE-2019-1003049", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Jenkins", "version": {"version_data": [{"version_value": "2.171 and earlier, LTS 2.164.1 and earlier"}]}}]}, "vendor_name": "Jenkins project"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, because the fix for CVE-2019-1003004 in these releases did not reject existing remoting-based CLI authentication caches."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-613"}]}]}, "references": {"reference_data": [{"name": "107901", "refsource": "BID", "url": "http://www.securityfocus.com/bid/107901"}, {"name": "RHBA-2019:1605", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHBA-2019:1605"}, {"name": "https://www.oracle.com/security-alerts/cpuapr2022.html", "refsource": "MISC", "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"}, {"name": "https://jenkins.io/security/advisory/2019-04-10/#SECURITY-1289", "refsource": "CONFIRM", "url": "https://jenkins.io/security/advisory/2019-04-10/#SECURITY-1289"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T03:07:18.205Z"}, "title": "CVE Program Container", "references": [{"name": "107901", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/107901"}, {"name": "RHBA-2019:1605", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHBA-2019:1605"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://jenkins.io/security/advisory/2019-04-10/#SECURITY-1289"}]}]}, "cveMetadata": {"assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "assignerShortName": "jenkins", "cveId": "CVE-2019-1003049", "datePublished": "2019-04-10T20:12:29", "dateReserved": "2019-04-10T00:00:00", "dateUpdated": "2024-08-05T03:07:18.205Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*", "matchCriteriaId": "2491F2AA-41E4-4220-8330-23D9969B61FC", "versionEndIncluding": "2.164.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*", "matchCriteriaId": "74C54E4A-7C75-4DA1-ABF9-CF345D3F0563", "versionEndIncluding": "2.171", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*", "matchCriteriaId": "2F87326E-0B56-4356-A889-73D026DB1D4B", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:*", "matchCriteriaId": "A4CA84D6-F312-4C29-A02B-050FCB7A902B", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, because the fix for CVE-2019-1003004 in these releases did not reject existing remoting-based CLI authentication caches."}, {"lang": "es", "value": "Los usuarios que almacenaron su autenticaci\u00f3n CLI antes de que Jenkins se actualizara a la versi\u00f3n 2.150.2 o posteriores, o a la versi\u00f3n 2.160 o posteriores, permanecer\u00edan autenticados en Jenkins 2.171 y anteriores y en Jenkins LTS 2.164.1 y anteriores, ya que la soluci\u00f3n para CVE-2019-1003004 en estas versiones no rechazaba las cach\u00e9s de autenticaci\u00f3n CLI remotas existentes."}], "id": "CVE-2019-1003049", "lastModified": "2023-10-25T18:16:04.353", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-04-10T21:29:01.480", "references": [{"source": "jenkinsci-cert@googlegroups.com", "tags": ["Broken Link"], "url": "http://www.securityfocus.com/bid/107901"}, {"source": "jenkinsci-cert@googlegroups.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHBA-2019:1605"}, {"source": "jenkinsci-cert@googlegroups.com", "tags": ["Vendor Advisory"], "url": "https://jenkins.io/security/advisory/2019-04-10/#SECURITY-1289"}, {"source": "jenkinsci-cert@googlegroups.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"}], "sourceIdentifier": "jenkinsci-cert@googlegroups.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-613"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHBA-2019:1605", "cpe": "cpe:/a:redhat:openshift:3.11::el7", "package": "atomic-enterprise-service-catalog-1:3.11.117-1.git.1.376e432.el7", "product_name": "Red Hat OpenShift Container Platform 3.11", "release_date": "2019-06-26T00:00:00Z"}, {"advisory": "RHBA-2019:1605", "cpe": "cpe:/a:redhat:openshift:3.11::el7", "package": "atomic-openshift-cluster-autoscaler-0:3.11.117-1.git.1.caa79fa.el7", "product_name": "Red Hat OpenShift Container Platform 3.11", "release_date": "2019-06-26T00:00:00Z"}, {"advisory": "RHBA-2019:1605", "cpe": "cpe:/a:redhat:openshift:3.11::el7", "package": "atomic-openshift-descheduler-0:3.11.117-1.git.1.1635b0a.el7", "product_name": "Red Hat OpenShift Container Platform 3.11", "release_date": "2019-06-26T00:00:00Z"}, {"advisory": "RHBA-2019:1605", "cpe": "cpe:/a:redhat:openshift:3.11::el7", "package": "atomic-openshift-dockerregistry-0:3.11.117-1.git.1.6a42b08.el7", "product_name": "Red Hat OpenShift Container Platform 3.11", "release_date": "2019-06-26T00:00:00Z"}, {"advisory": "RHBA-2019:1605", "cpe": "cpe:/a:redhat:openshift:3.11::el7", "package": "atomic-openshift-metrics-server-0:3.11.117-1.git.1.319d58e.el7", "product_name": "Red Hat OpenShift Container Platform 3.11", "release_date": "2019-06-26T00:00:00Z"}, {"advisory": "RHBA-2019:1605", "cpe": "cpe:/a:redhat:openshift:3.11::el7", "package": "atomic-openshift-node-problem-detector-0:3.11.117-1.git.1.0345fe3.el7", "product_name": "Red Hat OpenShift Container Platform 3.11", "release_date": "2019-06-26T00:00:00Z"}, {"advisory": "RHBA-2019:1605", "cpe": "cpe:/a:redhat:openshift:3.11::el7", "package": "atomic-openshift-service-idler-0:3.11.117-1.git.1.887bb82.el7", "product_name": "Red Hat OpenShift Container Platform 3.11", "release_date": "2019-06-26T00:00:00Z"}, {"advisory": "RHBA-2019:1605", "cpe": "cpe:/a:redhat:openshift:3.11::el7", "package": "atomic-openshift-web-console-0:3.11.117-1.git.1.be7a05c.el7", "product_name": "Red Hat OpenShift Container Platform 3.11", "release_date": "2019-06-26T00:00:00Z"}, {"advisory": "RHBA-2019:1605", "cpe": "cpe:/a:redhat:openshift:3.11::el7", "package": "cri-o-0:1.11.14-1.rhaos3.11.gitd56660e.el7", "product_name": "Red Hat OpenShift Container Platform 3.11", "release_date": "2019-06-26T00:00:00Z"}, {"advisory": "RHBA-2019:1605", "cpe": "cpe:/a:redhat:openshift:3.11::el7", "package": "golang-github-openshift-oauth-proxy-0:3.11.117-1.git.1.2b006d2.el7", "product_name": "Red Hat OpenShift Container Platform 3.11", "release_date": "2019-06-26T00:00:00Z"}, {"advisory": "RHBA-2019:1605", "cpe": "cpe:/a:redhat:openshift:3.11::el7", "package": "golang-github-prometheus-alertmanager-0:3.11.117-1.git.1.207ef35.el7", "product_name": "Red Hat OpenShift Container Platform 3.11", "release_date": "2019-06-26T00:00:00Z"}, {"advisory": "RHBA-2019:1605", "cpe": "cpe:/a:redhat:openshift:3.11::el7", "package": "golang-github-prometheus-node_exporter-0:3.11.117-1.git.1.dcee33f.el7", "product_name": "Red Hat OpenShift Container Platform 3.11", "release_date": "2019-06-26T00:00:00Z"}, {"advisory": "RHBA-2019:1605", "cpe": "cpe:/a:redhat:openshift:3.11::el7", "package": "golang-github-prometheus-prometheus-0:3.11.117-1.git.1.f52d417.el7", "product_name": "Red Hat OpenShift Container Platform 3.11", "release_date": "2019-06-26T00:00:00Z"}, {"advisory": "RHBA-2019:1605", "cpe": "cpe:/a:redhat:openshift:3.11::el7", "package": "jenkins-0:2.164.2.1555422716-1.el7", "product_name": "Red Hat OpenShift Container Platform 3.11", "release_date": "2019-06-26T00:00:00Z"}, {"advisory": "RHBA-2019:1605", "cpe": "cpe:/a:redhat:openshift:3.11::el7", "package": "jenkins-2-plugins-0:3.11.1559667994-1.el7", "product_name": "Red Hat OpenShift Container Platform 3.11", "release_date": "2019-06-26T00:00:00Z"}, {"advisory": "RHBA-2019:1605", "cpe": "cpe:/a:redhat:openshift:3.11::el7", "package": "openshift-ansible-0:3.11.123-1.git.0.db681ba.el7", "product_name": "Red Hat OpenShift Container Platform 3.11", "release_date": "2019-06-26T00:00:00Z"}, {"advisory": "RHBA-2019:1605", "cpe": "cpe:/a:redhat:openshift:3.11::el7", "package": "openshift-enterprise-autoheal-0:3.11.117-1.git.1.ef32a58.el7", "product_name": "Red Hat OpenShift Container Platform 3.11", "release_date": "2019-06-26T00:00:00Z"}, {"advisory": "RHBA-2019:1605", "cpe": "cpe:/a:redhat:openshift:3.11::el7", "package": "openshift-enterprise-cluster-capacity-0:3.11.117-1.git.1.6593fce.el7", "product_name": "Red Hat OpenShift Container Platform 3.11", "release_date": "2019-06-26T00:00:00Z"}], "bugzilla": {"description": "jenkins: Jenkins accepted cached legacy CLI authentication", "id": "1699701", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1699701"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.0", "cvss3_scoring_vector": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "status": "verified"}, "cwe": "CWE-287", "details": ["Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, because the fix for CVE-2019-1003004 in these releases did not reject existing remoting-based CLI authentication caches."], "name": "CVE-2019-1003049", "package_state": [{"cpe": "cpe:/a:redhat:openshift:3.10", "fix_state": "Will not fix", "package_name": "jenkins", "product_name": "Red Hat OpenShift Container Platform 3.10"}, {"cpe": "cpe:/a:redhat:openshift:3.4", "fix_state": "Out of support scope", "package_name": "jenkins", "product_name": "Red Hat OpenShift Container Platform 3.4"}, {"cpe": "cpe:/a:redhat:openshift:3.5", "fix_state": "Out of support scope", "package_name": "jenkins", "product_name": "Red Hat OpenShift Container Platform 3.5"}, {"cpe": "cpe:/a:redhat:openshift:3.6", "fix_state": "Will not fix", "package_name": "jenkins", "product_name": "Red Hat OpenShift Container Platform 3.6"}, {"cpe": "cpe:/a:redhat:openshift:3.7", "fix_state": "Will not fix", "package_name": "jenkins", "product_name": "Red Hat OpenShift Container Platform 3.7"}, {"cpe": "cpe:/a:redhat:openshift:3.9", "fix_state": "Will not fix", "package_name": "jenkins", "product_name": "Red Hat OpenShift Container Platform 3.9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "jenkins", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2019-04-10T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2019-1003049\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-1003049\nhttps://jenkins.io/security/advisory/2019-04-10/#SECURITY-1289"], "threat_severity": "Moderate", "upstream_fix": "jenkins 2.172, jenkins 2.164.2"}