======================================================================

                               CERT-Renater

                   Note d'Information No. 2024/VULN208
_____________________________________________________________________

DATE                : 18/04/2024

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Jenkins (core) versions prior
                           to weekly 2.452, LTS 2.440.3.

=====================================================================
https://www.jenkins.io/security/advisory/2024-04-17/
_____________________________________________________________________


Jenkins Security Advisory 2024-04-17

This advisory announces vulnerabilities in the following Jenkins
deliverables:

     Jenkins (core)

Descriptions
Terrapin SSH vulnerability in Jenkins CLI client
SECURITY-3386 / CVE-2023-48795
Severity (CVSS): Medium

Description:

The CLI client (jenkins-cli.jar) in Jenkins 2.451 and earlier,
LTS 2.440.2 and earlier bundles versions of the Apache MINA SSHD
library that are susceptible to CVE-2023-48795 (Terrapin attack).
This vulnerability allows a machine-in-the-middle attacker to reduce
the security of an SSH connection.

This only affects the Jenkins CLI client when using the -ssh
connection mode, which is not the default.

The CLI client (jenkins-cli.jar) in Jenkins 2.452, LTS 2.440.3 bundles
version 2.12.1 of the Apache MINA SSHD library, which is unaffected
by this issue.


Severity

     SECURITY-3386: Medium


Affected Versions

     Jenkins weekly up to and including 2.451
     Jenkins LTS up to and including 2.440.2

Fix

     Jenkins weekly should be updated to version 2.452
     Jenkins LTS should be updated to version 2.440.3

These versions include fixes to the vulnerabilities described above.
All prior versions are considered to be affected by these
vulnerabilities unless otherwise indicated.


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================