https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 23:30:14 +0000 https://cve.radiocsirt.org/vuln/bit-jenkins-2020-2099 <p><strong>Affected:</strong> Bitnami: jenkins</p> <p>Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents, which can be used to connect to Jenkins, impersonating those agents.</p> <p><strong>Affected:</strong> Bitnami: jenkins</p> <p>Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents, which can be used to connect to Jenkins, impersonating those agents.</p> https://cve.radiocsirt.org/vuln/bit-jenkins-2020-2099 https://cve.radiocsirt.org/vuln/cnvd-2020-17200 cnvd-2020-17200 https://cve.radiocsirt.org/vuln/cnvd-2020-17200 https://cve.radiocsirt.org/vuln/euvd-2026-35791 EUVD-2026-35791 https://cve.radiocsirt.org/vuln/euvd-2026-35791 https://cve.radiocsirt.org/vuln/fkie_cve-2020-2099 <p>Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents, which can be used to connect to Jenkins, impersonating those agents.</p> <p>Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents, which can be used to connect to Jenkins, impersonating those agents.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2020-2099 https://cve.radiocsirt.org/vuln/ghsa-qp4f-2w67-c8hw <p><strong>Affected:</strong> Maven: org.jenkins-ci.main:jenkins-core</p> <p>Jenkins 2.213 and earlier, LTS 2.204.1 and earlier includes support for the Inbound TCP Agent Protocol/3 for communication between controller and agents. While [this protocol has been deprecated in 2018](https://www.jenkins.io/changelog-old/#v2.128) and was recently removed from Jenkins in 2.214, it could still easily be enabled in Jenkins LTS 2.204.1, 2.213, and older.</p> <p>This protocol incorrectly reuses encryption parameters which allow an unauthenticated remote attacker to determine the connection secret. This secret can then be used to connect attacker-controlled Jenkins agents to the Jenkins controller.</p> <p>Jenkins 2.204.2 no longer allows for the use of Inbound TCP Agent Protocol/3 by default. The system property `jenkins.slaves.JnlpSlaveAgentProtocol3.ALLOW_UNSAFE` can be set to `true` to allow enabling the Inbound TCP Agent Protocol/3 in Jenkins 2.204.2, but doing so is strongly discouraged.</p> <p>Inbound TCP Agent Protocol/3 was removed completely from Jenkins 2.214 and will not be part of Jenkins LTS after the end of the 2.204.x line.</p> <p><strong>Affected:</strong> Maven: org.jenkins-ci.main:jenkins-core</p> <p>Jenkins 2.213 and earlier, LTS 2.204.1 and earlier includes support for the Inbound TCP Agent Protocol/3 for communication between controller and agents. While [this protocol has been deprecated in 2018](https://www.jenkins.io/changelog-old/#v2.128) and was recently removed from Jenkins in 2.214, it could still easily be enabled in Jenkins LTS 2.204.1, 2.213, and older.</p> <p>This protocol incorrectly reuses encryption parameters which allow an unauthenticated remote attacker to determine the connection secret. This secret can then be used to connect attacker-controlled Jenkins agents to the Jenkins controller.</p> <p>Jenkins 2.204.2 no longer allows for the use of Inbound TCP Agent Protocol/3 by default. The system property `jenkins.slaves.JnlpSlaveAgentProtocol3.ALLOW_UNSAFE` can be set to `true` to allow enabling the Inbound TCP Agent Protocol/3 in Jenkins 2.204.2, but doing so is strongly discouraged.</p> <p>Inbound TCP Agent Protocol/3 was removed completely from Jenkins 2.214 and will not be part of Jenkins LTS after the end of the 2.204.x line.</p> https://cve.radiocsirt.org/vuln/ghsa-qp4f-2w67-c8hw https://cve.radiocsirt.org/vuln/gsd-2020-2099 gsd-2020-2099 https://cve.radiocsirt.org/vuln/gsd-2020-2099 https://cve.radiocsirt.org/vuln/rhba-2020:0402 <p>jquery: Prototype pollution in object&#39;s prototype leading to denial of service, remote code execution, or property injection jenkins: Inbound TCP Agent Protocol/3 authentication bypass jenkins: UDP multicast/broadcast service amplification reflection attack jenkins: Non-constant time comparison of inbound TCP agent connection secret jenkins: Non-constant time HMAC comparison jenkins: Exposed session identifiers on user detail object in the whoAmI diagnostic page jenkins: Memory usage graphs accessible to anyone with Overall/Read jenkins: REST APIs vulnerable to clickjacking</p> <p>jquery: Prototype pollution in object&#39;s prototype leading to denial of service, remote code execution, or property injection jenkins: Inbound TCP Agent Protocol/3 authentication bypass jenkins: UDP multicast/broadcast service amplification reflection attack jenkins: Non-constant time comparison of inbound TCP agent connection secret jenkins: Non-constant time HMAC comparison jenkins: Exposed session identifiers on user detail object in the whoAmI diagnostic page jenkins: Memory usage graphs accessible to anyone with Overall/Read jenkins: REST APIs vulnerable to clickjacking</p> https://cve.radiocsirt.org/vuln/rhba-2020:0402