Overview
JumpServer has released an update to address a vulnerability in their products. Users of affected versions are advised to update to the latest version.
Affected Products
CVE-2024-40628, CVE-2024-40629
- JumpServer versions: 3.0.0 (inclusive) ~ 3.10.11 (inclusive)
Resolved Vulnerabilities
An attacker could exploit an Ansible playbook to read arbitrary files from a Celery container, resulting in sensitive information disclosure (CVE-2024-40628)
Vulnerability where an attacker could exploit Ansible playbooks to write arbitrary files to perform remote code execution (RCE) on Celery containers (CVE-2024-40629)
Vulnerability Patches
Vulnerability patches have been made available in the latest updates. Please follow the instructions on the Referenced Sites to update to the latest Vulnerability Patches version.
CVE-2024-40628, CVE-2024-40629
- JumpServer version: 3.10.12
- JumpServer version: 4.0.0
Referenced Sites
[1] CVE-2024-40628 Detail
https://nvd.nist.gov/vuln/detail/CVE-2024-40628
[2] CVE-2024-40629 Detail
https://nvd.nist.gov/vuln/detail/CVE-2024-40629
[3] Arbitrary File Read in Ansible Playbooks
https://github.com/jumpserver/jumpserver/security/advisories/GHSA-rpf7-g4xh-84v9
Article Link: JumpServer Security Update Advisory (CVE-2024-40628, CVE-2024-40629) – ASEC