^{CVE-2020-2100:}Jenkins UDP Amplification Reflection Denial of Service Vulnerability

Overview

This vulnerability (CVE-2020-2100) affects Jenkins core versions 2.218 and earlier, as well as LTS versions 2.204.1 and earlier. The issue stems from a UDP service running on port 33848 that could be exploited in reflection/amplification DDoS attacks. In such attacks, the attacker sends a small amount of traffic with a spoofed source IP address to the vulnerable Jenkins server, which then responds with a significantly larger amount of data to the victim's IP address. This amplification effect allows attackers to generate large volumes of traffic directed at target systems while hiding their true source.

Remediation

To address this vulnerability, users should upgrade to Jenkins 2.219 or LTS 2.204.2 or later versions, which contain the fix for this issue. If immediate upgrading is not possible, administrators should consider implementing network-level protections such as:

1. Block UDP traffic on port 33848 at the firewall level
2. Implement rate limiting for UDP traffic
3. Use intrusion detection/prevention systems to identify and block potential amplification attacks
4. Consider using a reverse proxy or WAF (Web Application Firewall) to protect Jenkins instances

For Red Hat users, several updates have been released to address this vulnerability, as referenced in the advisory errata RHBA-2020:0402, RHBA-2020:0675, RHSA-2020:0681, and RHSA-2020:0683.

References

1. Jenkins Security Advisory (2020-01-29): https://jenkins.io/security/advisory/2020-01-29/#SECURITY-1641
2. OSS Security Mailing List: http://www.openwall.com/lists/oss-security/2020/01/29/1
3. Red Hat Errata RHBA-2020:0402: https://access.redhat.com/errata/RHBA-2020:0402
4. Red Hat Errata RHBA-2020:0675: https://access.redhat.com/errata/RHBA-2020:0675
5. Red Hat Errata RHSA-2020:0681: https://access.redhat.com/errata/RHSA-2020:0681
6. Red Hat Errata RHSA-2020:0683: https://access.redhat.com/errata/RHSA-2020:0683