Read the docs
TI-2020-01976 Aliases CVE-2020-2099GHSA-qp4f-2w67-c8hw

Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key…

Priority LOW 39CWE-330Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents, which can be used to connect to Jenkins, impersonating those agents.

Why it matters now

EPSS 0.01012 63rd percentileScored 2026-11-07
Fix Fixed org.jenkins-ci.main:jenkins-core (Maven): 2.204.2, 2.214

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
JenkinsJenkinsup to 2.213; up to LTS 2.204.1—No fix listedCNA
—org.jenkins-ci.main:jenkins-core (Maven)before 2.204.22.204.2Patch availableGHSA-qp4f-2w67-c8hw
—org.jenkins-ci.main:jenkins-core (Maven)2.205 to before 2.2142.214Patch availableGHSA-qp4f-2w67-c8hw
  • Jenkins VendorJenkins Affected up to 2.213; up to LTS 2.204.1 Fixed in — No fix listed CNA
  • org.jenkins-ci.main:jenkins-core (Maven) Vendor— Affected before 2.204.2 Fixed in 2.204.2 Patch available GHSA-qp4f-2w67-c8hw
  • org.jenkins-ci.main:jenkins-core (Maven) Vendor— Affected 2.205 to before 2.214 Fixed in 2.214 Patch available GHSA-qp4f-2w67-c8hw

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*up to 2.204.1VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*up to 2.218VulnerableJenkins
  • cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:* Versions up to 2.204.1 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:* Versions up to 2.218 Vulnerable ·Jenkins

Remediation

  • Fix · GHSA-qp4f-2w67-c8hw org.jenkins-ci.main:jenkins-core (Maven) Fixed in 2.204.2 Advisory →
  • Fix · GHSA-qp4f-2w67-c8hw org.jenkins-ci.main:jenkins-core (Maven) Fixed in 2.214 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Jenkins — RHBA-2020:0402

    7 records Highest priority Priority LOW 7 LOW

    Other records, highest priority first

    • TI-2020-01980 Information disclosure in JenkinsPriority LOW 34
    • TI-2020-01977 Jenkins 2.218 and earlier, LTS 2.204.1 and earlier was vulnerable to a UDP amplification…Priority LOW 32
    • TI-2020-01982 REST API endpoints in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier were vulnerable to clickjacking attacks.Priority LOW 28
    Show all 7 records → Advisory →
  • Advisory ·

    Jenkins — RHBA-2020:0675

    7 records Highest priority Priority LOW 7 LOW

    Other records, highest priority first

    • TI-2020-01980 Information disclosure in JenkinsPriority LOW 34
    • TI-2020-01977 Jenkins 2.218 and earlier, LTS 2.204.1 and earlier was vulnerable to a UDP amplification…Priority LOW 32
    • TI-2020-01982 REST API endpoints in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier were vulnerable to clickjacking attacks.Priority LOW 28
    Show all 7 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 3.11Fixed—
Red Hat OpenShift Container Platform 4.3Fixed—
Red Hat OpenShift Container Platform 4.4Fixed—
Red Hat OpenShift Container Platform 4.5Fixed—
Not affected: 1 product
  • Red Hat OpenShift Container Platform 4.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-2099
  2. 2026-10-03 Alias added: GHSA-qp4f-2w67-c8hw
  3. 2026-10-30 Fix available: Red Hat OpenShift Container Platform 4.4, Red Hat OpenShift Container Platform 4.5 · Red Hat

References

Advisory 7

Other 2

  • TI-2024-15885 Path traversal in Jenkins KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-14573 Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an… KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2015-04472 The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote… KEVCVSS 3.1HIGH 7.5
  • TI-2016-07596 The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers… CVSS 3.0CRITICAL 9.8
See all 293 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences