[<prev] [next>] [day] [month] [year] [list]
Message-Id: <3E15589B-2D44-4A55-B15F-FC686E0E8F59@beckweb.net>
Date: Thu, 4 Nov 2021 15:20:37 +0100
From: Daniel Beck <ml@...kweb.net>
To: oss-security@...ts.openwall.com
Subject: Multiple vulnerabilities in Jenkins and Jenkins plugins
Subject: Multiple vulnerabilities in Jenkins and Jenkins plugins
Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software.
The following releases contain fixes for security vulnerabilities:
* Jenkins 2.319
* Jenkins LTS 2.303.3
* Subversion Plugin 2.15.1
Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:
https://www.jenkins.io/security/advisory/2021-11-04/
We provide advance notification for security updates on this mailing list:
https://groups.google.com/d/forum/jenkinsci-advisories
If you discover security vulnerabilities in Jenkins, please report them as
described here:
https://www.jenkins.io/security/#reporting-vulnerabilities
---
SECURITY-2455 / CVE-2021-21685 through CVE-2021-21695
The agent-to-controller security subsystem limits which files on the
Jenkins controller can be accessed by agent processes.
Multiple vulnerabilities in the file path filtering implementation of
Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allow agent processes to
read and write arbitrary files on the Jenkins controller file system, and
obtain some information about Jenkins controller file systems.
SECURITY-2423 / CVE-2021-21696
Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not limit agent
read/write access to the `libs/` directory inside build directories when
using the `FilePath` APIs. This directory is used by the Pipeline: Shared
Groovy Libraries Plugin to store copies of shared libraries.
This allows attackers in control of agent processes to replace the code of
a trusted library with a modified variant, resulting in unsandboxed code
execution in the Jenkins controller process.
SECURITY-2428 / CVE-2021-21697
Agents are allowed some limited access to files on the Jenkins controller
file system. The directories agents are allowed to access in Jenkins 2.318
and earlier, LTS 2.303.2 and earlier include the directories storing
build-related information, intended to allow agents to store build-related
metadata during build execution. As a consequence, this allows any agent to
read and write the contents of any build directory stored in Jenkins with
very few restrictions (`build.xml` and some Pipeline-related metadata).
SECURITY-2506 / CVE-2021-21698
Subversion Plugin 2.15.0 and earlier does not restrict the name of a file
when looking up a subversion key file on the controller from an agent.
This allows attackers able to control agent processes to read arbitrary
files on the Jenkins controller file system.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
