CVE-2017-1000362
Description
The re-key admin monitor was introduced in Jenkins 1.498 and re-encrypted all secrets in JENKINS_HOME with a new key. It also created a backup directory with all old secrets, and the key used to encrypt them. These backups were world-readable and not removed afterwards. Jenkins now deletes the backup directory, if present. Upgrading from before 1.498 will no longer create a backup directory. Administrators relying on file access permissions in their manually created backups are advised to check them for the directory $JENKINS_HOME/jenkins.security.RekeySecretAdminMonitor/backups, and delete it if present.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.jenkins-ci.main:jenkins-coreMaven | >= 1.498, < 2.32.2 | 2.32.2 |
org.jenkins-ci.main:jenkins-coreMaven | >= 2.40, < 2.44 | 2.44 |
Affected products
2Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-92mr-4w2q-4578ghsaADVISORY
- jenkins.io/security/advisory/2017-02-01/nvdVendor Advisory
- nvd.nist.gov/vuln/detail/CVE-2017-1000362ghsaADVISORY
- github.com/jenkinsci/jenkins/commit/0be33cf7328fad6a7596ce9505a74561a8b1eb85ghsaWEB
- github.com/jenkinsci/jenkins/commit/a572450f039fdb99410fcf6eb0ba307bd69ea458ghsaWEB
- jenkins.io/security/advisory/2017-02-01ghsaWEB
News mentions
0No linked articles in our index yet.