Skip to content
Fencer Vulns
medium 4.3

CVE-2021-21639 json

Lack of type validation in agent related REST API in Jenkins

published 2021-04-07 5 y ago modified 2026-09-08 2 mo ago also BIT-jenkins-2021-21639 , EUVD-2022-4831 , GHSA-pvwx-3jx5-24r2

cvss
4.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.7%
EPSS 2.7% chance of exploitation in 30 days, percentile 86%
public exploits
0
none known

Summary

Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type of object created after loading the data submitted to the `config.xml` REST API endpoint of a node, allowing attackers with Computer/Configure permission to replace a node with one of a different type.

Patch / fix

  • maven org.jenkins-ci.main:jenkins-core 2.277.2, 2.287
  • bitnami jenkins 2.286.1
  • runc openshift 4.7 1.0.0-95.rhaos4.8.gitcd80260.el7
  • runc openshift 4.7 1.0.0-95.rhaos4.8.gitcd80260.el8
  • jenkins openshift 4.7 2.277.3.1620393611-1.el8
  • cri-tools openshift 4.7 1.20.0-2.el7
  • cri-tools openshift 4.7 1.20.0-2.el8
  • runc openshift 4.8 1.0.0-98.rhaos4.8.gitcd80260.el7
  • runc openshift 4.8 1.0.0-98.rhaos4.8.gitcd80260.el8
  • cri-o openshift 4.8 1.21.2-5.rhaos4.8.gitb27d974.el7

red hat advisories RHSA-2021:1551RHSA-2021:2437

  • jenkins Alpine 3.24, Alpine 3.23, Alpine 3.22 +9 more 2.287-r0

alpine advisories ALPINE-CVE-2021-21639

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • jenkins Arch Linux 2.287-1

arch linux advisories AVG-1781

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-21639 updated cvss 3.1

jenkins: lack of type validation in agent related REST API

  • Red Hat OpenShift Container Platform 3.11 jenkins
    affected: no fix available “Fix deferred”
  • Red Hat OpenShift Container Platform 4.7 jenkins 2.277.3.1620393611-1.el8
    fixed: vendor fix RHSA-2021:1551
  • Red Hat OpenShift Container Platform 4.8 jenkins 2.289.1.1624020353-1.el8
    fixed: vendor fix RHSA-2021:2437
  • Red Hat Fuse 7 jenkins Red Hat OpenShift Container Platform 4.7 cri-tools 1.20.0-2.el7, cri-tools 1.20.0-2.el8, runc 1.0.0-95.rhaos4.8.gitcd80260.el7, runc 1.0.0-95.rhaos4.8.gitcd80260.el8, cri-o 1.20.2-11.rhaos4.7.git704b03d.el7, cri-o 1.20.2-11.rhaos4.7.git704b03d.el8, +23 more Red Hat OpenShift Container Platform 4.8 podman 3.0.1-6.el8, haproxy 2.2.13-1.el7, haproxy 2.2.13-1.el8, ostree 2020.7-5.el8_4, cri-tools 1.21.0-2.el7, cri-tools 1.21.0-2.el8, +133 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.73% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
GitHub 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
NVD 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
NVD 2.0 4.0 AV:N/AC:L/Au:S/C:N/I:P/A:N
OSV 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected packages

ecosystem package affected fixed in
maven org.jenkins-ci.main:jenkins-core
<2.277.2
>=2.278, <2.287
2.277.2
2.287
bitnami jenkins
<2.286.1
2.286.1

Affected products

  • Jenkins project Jenkins

Classification

Weakness
  • CWE-20 Improper Input Validation
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.