Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, because the fix for CVE-2019-1003004 in these releases did not reject existing remoting-based CLI authentication caches.

Affected Packages

Maven org.jenkins-ci.main:jenkins-core

Affected versions: 0 (fixed in 2.164.2)

Maven org.jenkins-ci.main:jenkins-core

Affected versions: 2.165 (fixed in 2.172)

Related CVEs

CVE-2019-1003049

Key Information

GHSA ID

GHSA-742j-jcfr-23w3

Published

May 13, 2022 1:01 AM

Last Modified

June 29, 2022 2:08 PM

CVSS Score

7.5 /10

Primary Ecosystem

Maven

Primary Package

org.jenkins-ci.main:jenkins-core

GitHub Reviewed

✓ Yes

Dataset

Last updated: July 1, 2025 6:26 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.