CloudBees Security Advisory 2017-12-14

This advisory announces two vulnerabilities in Jenkins, CloudBees Jenkins Platform and CloudBees Jenkins Solutions.

SECURITY-667

A race condition during Jenkins startup could result in the wrong order of execution of commands during initialization.

On affected versions, this could, in rare cases (current estimation is less than 20% of new instances), result in failure to initialize the setup wizard on the first startup. This resulted in the following security settings not being set to their usual strict default:

• No security realm was defined, and no admin user was created whose password was written to the Jenkins log or the initialAdminPassword file.

• The authorization strategy remained Anyone can do anything rather than Logged-in users can do anything .

• TCP port for JNLP agents , usually disabled by default, was open, unless a Java system property controlling it was set.

• CLI over Remoting was enabled.

• CSRF Protection was disabled.

• Agent → Master Access Control was disabled.

• Affected instances need to be configured to restrict access.

SECURITY-667

A race condition during Jenkins startup could result in the wrong order of execution of commands during initialization.

There’s a very short window of time after startup during which Jenkins may no longer show the "Please wait while Jenkins is getting ready to work" message, but Cross-Site Request Forgery (CSRF) protection may not yet be effective. As of publication of this advisory, we’ve been unable to confirm this can actually be exploited, but generally recommend that users upgrade to the versions including the fix.

• SECURITY-667: high

The following Jenkins, CloudBees Jenkins Platform, and CloudBees Jenkins Solutions are affected:

• Random failures to initialize the setup wizard on startup:

  • CloudBees Jenkins Enterprise 1.11.0.

  • CloudBees Jenkins Platform (rolling train, CloudBees Jenkins Operations Center and CloudBees Jenkins Enterprise 2.x.y.z) 2.89.1.6.

  • CloudBees Jenkins Team up to and including 2.89.1.6

  • Jenkins LTS 2.89.1

  • Jenkins main line 2.81 through 2.94 (inclusive)

• CSRF protection delayed after startup:

  • CloudBees Jenkins Enterprise up to and including 1.11.0.

  • CloudBees Jenkins Platform (rolling train, CloudBees Jenkins Operations Center and CloudBees Jenkins Enterprise 2.x.y.z) up to and including 2.89.1.6.

  • CloudBees Jenkins Platform (fixed train, CloudBees Jenkins Operations Center and CloudBees Jenkins Enterprise 2.46.x.0.y) up to and including 2.46.27.0.1

  • CloudBees Jenkins Team up to and including 2.89.1.6

  • Jenkins LTS up to and including 2.89.1

  • Jenkins main line up to and including 2.94

• CloudBees Jenkins Enterprise should be upgraded to 1.11.1.

• CloudBees Jenkins Platform (rolling train, CloudBees Jenkins Operations Center and CloudBees Jenkins Enterprise 2.x.y.z) should be upgraded to 2.89.1.7

• CloudBees Jenkins Platform (fixed train, CloudBees Jenkins Operations Center and CloudBees Jenkins Enterprise 2.46.x.0.y) should be upgraded to 2.46.28.0.1

• CloudBees Jenkins Team should be upgraded to 2.89.1.7

• DEV@cloud is already protected.

• Jenkins:

  • Jenkins LTS should be upgraded to 2.89.2

  • Jenkins main line should be upgraded to 2.95

Instances that were installed using the affected versions for "Random failures to initialize the setup wizard on startup" should review all the options of the Configure Global Security screen.