CVE-2020-2308: Missing Authorization in Jenkins Kubernetes Plugin
Summary
CVE-2020-2308: Missing Authorization in Jenkins Kubernetes Plugin. Affects org.csanchez.jenkins.plugins:kubernetes across 4 version ranges.
< 1.21.6
>= 1.22.0, < 1.25.4.1
>= 1.26.0, < 1.26.5
>= 1.27.1, < 1.27.4
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Kubernetes Plugin is a Maven package that provides integration between Jenkins and Kubernetes. It allows users to dynamically provision Jenkins agents using Kubernetes pods. This plugin is widely used in CI/CD pipelines to automate the deployment of applications on Kubernetes clusters.
Vulnerability Detail
The Jenkins Kubernetes Plugin versions prior to 1.27.4, 1.26.5, 1.25.4.1, and 1.21.6 suffer from a missing authorization vulnerability. An HTTP endpoint in the plugin does not perform a permission check, allowing attackers with Overall/Read permission to list global pod template names. This can lead to unauthorized access and potential information disclosure.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.21.61.21.6 -
>= 1.22.0, < 1.25.4.11.25.4.1 -
>= 1.26.0, < 1.26.51.26.5 -
>= 1.27.1, < 1.27.41.27.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed versions mentioned above.
Conclusion
The Jenkins Kubernetes Plugin prior to versions 1.27.4, 1.26.5, 1.25.4.1, and 1.21.6 is vulnerable to unauthorized access and information disclosure. It is crucial to upgrade to the fixed versions to mitigate this risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.csanchez.jenkins.plugins:kubernetes →
FAQ
This vulnerability allows attackers with Overall/Read permission to list global pod template names, potentially leading to unauthorized access and information disclosure.
No, only versions prior to 1.27.4, 1.26.5, 1.25.4.1, and 1.21.6 are affected. It is recommended to upgrade to the fixed versions.
No, there is no known workaround. Upgrading to the fixed versions is the recommended solution.
Attackers with Overall/Read permission can exploit this vulnerability to list global pod template names.
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-rr6j-37cv-c7x7/GHSA-rr6j-37cv-c7x7.json
References
Related vulnerabilities
Recent vulnerabilities recorded for org.csanchez.jenkins.plugins:kubernetes.
