[<prev] [next>] [day] [month] [year] [list]
Message-Id: <5DAF172D-4EC3-48C9-9A8C-C55B14478B40@beckweb.net>
Date: Wed, 24 Feb 2021 15:52:03 +0100
From: Daniel Beck <ml@...kweb.net>
To: oss-security@...ts.openwall.com
Subject: Multiple vulnerabilities in Jenkins plugins
Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software.
The following releases contain fixes for security vulnerabilities:
* Active Choices Plugin 2.5.3
* Artifact Repository Parameter Plugin 1.0.1
* Claim Plugin 2.18.2
* Configuration Slicing Plugin 1.52
* Repository Connector Plugin 2.0.3
* Support Core Plugin 2.72.1
Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:
https://www.jenkins.io/security/advisory/2021-02-24/
We provide advance notification for security updates on this mailing list:
https://groups.google.com/d/forum/jenkinsci-advisories
If you discover security vulnerabilities in Jenkins, please report them as
described here:
https://www.jenkins.io/security/#reporting-vulnerabilities
---
SECURITY-2192 / CVE-2021-21616
Active Choices Plugin 2.5.2 and earlier does not escape reference parameter
values.
This results in a stored cross-site scripting (XSS) vulnerability
exploitable by attackers with Job/Configure permission.
SECURITY-2003 / CVE-2021-21617
Configuration Slicing Plugin 1.51 and earlier does not require POST
requests for the form submission endpoint reconfiguring slices, resulting
in a cross-site request forgery (CSRF) vulnerability.
This vulnerability allows attackers to apply different slice configurations
to attacker-specified jobs.
SECURITY-2183 / CVE-2021-21618
Repository Connector Plugin 2.0.2 and earlier does not escape parameter
names and descriptions for past builds.
This results in a stored cross-site scripting (XSS) vulnerability
exploitable by attackers with Item/Configure permission.
SECURITY-2188 (1) / CVE-2021-21619
Claim Plugin 2.18.1 and earlier does not escape the user display name shown
in claims.
This results in a cross-site scripting (XSS) vulnerability exploitable by
attackers who are able to control the display names of Jenkins users,
either via the security realm, or directly inside Jenkins.
NOTE: Everyone with a Jenkins account can change their own display name.
SECURITY-2188 (2) / CVE-2021-21620
Claim Plugin 2.18.1 and earlier does not require POST requests for the form
submission endpoint assigning claims, resulting in a cross-site request
forgery (CSRF) vulnerability.
This vulnerability allows attackers to change claims.
SECURITY-2150 / CVE-2021-21621
Support Core Plugin 2.72 and earlier provides the serialized user
authentication as part of the "About user (basic authentication details
only)" information (`user.md`).
In some configurations, this can include the session ID of the user
creating the support bundle. Attackers with access to support bundle
content and the Jenkins instance could use this information to impersonate
the user who created the support bundle.
SECURITY-2168 / CVE-2021-21622
Artifact Repository Parameter Plugin 1.0.0 and earlier does not escape
parameter names and descriptions.
This results in a stored cross-site scripting (XSS) vulnerability
exploitable by attackers with Job/Configure permission.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
