[<prev] [next>] [day] [month] [year] [list]
Message-Id: <B6CBEED3-F9D1-445F-8F6D-643C6F9F0EAE@beckweb.net>
Date: Tue, 1 Oct 2019 15:27:41 +0200
From: Daniel Beck <ml@...kweb.net>
To: oss-security@...ts.openwall.com
Subject: Multiple vulnerabilities in Jenkins plugins
Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software. The following
releases contain fixes for security vulnerabilities:
* HTML Publisher Plugin 1.21
* Script Security Plugin 1.65
Additionally, we announce unresolved security issues in the following
plugins:
* Dingding[钉钉] Plugin
* LDAP Email
* SourceGear Vault
Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:
https://jenkins.io/security/advisory/2019-10-01/
We provide advance notification for security updates on this mailing list:
https://groups.google.com/d/forum/jenkinsci-advisories
If you discover security vulnerabilities in Jenkins, please report them as
described here:
https://jenkins.io/security/#reporting-vulnerabilities
---
SECURITY-1579 / CVE-2019-10431
Sandbox protection in Script Security Plugin could be circumvented through
default parameter expressions in constructors.
This allowed attackers able to specify and run sandboxed scripts to
execute arbitrary code in the context of the Jenkins master JVM.
SECURITY-1590 / CVE-2019-10432
HTML Publisher Plugin did not escape the project or build display name
shown in the frame HTML page. This resulted in a cross-site scripting
vulnerability exploitable by attackers able to control the project or
build display name, typically users with Job/Configure or Build/Update
permission.
SECURITY-1423 / CVE-2019-10433
Dingding[钉钉] Plugin stores an access token unencrypted in job config.xml
files on the Jenkins master. This token can be viewed by users with
Extended Read permission, or access to the master file system.
As of publication of this advisory, there is no fix.
SECURITY-1515 / CVE-2019-10434
LDAP Email Plugin stores an LDAP bind password in its global Jenkins
configuration.
While the password is stored encrypted on disk, it is transmitted in plain
text as part of the configuration form. This can result in exposure of the
password through browser extensions, cross-site scripting vulnerabilities,
and similar situations.
As of publication of this advisory, there is no fix.
SECURITY-1524 / CVE-2019-10435
SourceGear Vault Plugin stores an SCM password in job configurations.
While the password is stored encrypted on disk, it is transmitted in plain
text as part of the configuration form. This can result in exposure of the
password through browser extensions, cross-site scripting vulnerabilities,
and similar situations.
As of publication of this advisory, there is no fix.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
