[<prev] [next>] [day] [month] [year] [list]
Message-Id: <26FA0F7F-3AA3-467E-BBC5-142319CD6C28@beckweb.net>
Date: Wed, 20 Sep 2023 17:46:40 +0200
From: Daniel Beck <ml@...kweb.net>
To: oss-security@...ts.openwall.com
Subject: Multiple vulnerabilities in Jenkins and Jenkins plugins
Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software.
The following releases contain fixes for security vulnerabilities:
* Jenkins 2.424
* Jenkins LTS 2.414.2
* Build Failure Analyzer Plugin 2.4.2
Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:
https://www.jenkins.io/security/advisory/2023-09-20/
We provide advance notification for security updates on this mailing list:
https://groups.google.com/d/forum/jenkinsci-advisories
If you discover security vulnerabilities in Jenkins, please report them as
described here:
https://www.jenkins.io/security/#reporting-vulnerabilities
---
SECURITY-3261 / CVE-2023-43494
Jenkins allows filtering builds in the build history widget by specifying
an expression that searches for matching builds by name, description,
parameter values, etc.
Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1
(both inclusive) does not exclude sensitive build variables (e.g., password
parameter values) from this search.
This allows attackers with Item/Read permission to obtain values of
sensitive variables used in builds by iteratively testing different
characters until the correct sequence is discovered.
SECURITY-3245 / CVE-2023-43495
`ExpandableDetailsNote` allows annotating build log content with additional
information that can be revealed when interacted with.
Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the
value of the `caption` constructor parameter of `ExpandableDetailsNote`.
This results in a stored cross-site scripting (XSS) vulnerability
exploitable by attackers able to provide `caption` parameter values.
NOTE: As of publication, the related API is not used within Jenkins (core),
and the Jenkins security team is not aware of any affected plugins.
SECURITY-3072 / CVE-2023-43496
Jenkins creates a temporary file when a plugin is deployed directly from a
URL.
Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates this temporary
file in the system temporary directory with the default permissions for
newly created files.
If these permissions are overly permissive, they may allow attackers with
access to the Jenkins controller file system to read and write the file
before it is installed in Jenkins, potentially resulting in arbitrary code
execution.
IMPORTANT: This vulnerability only affects operating systems using a shared
temporary directory for all users (typically Linux). Additionally, the
default permissions for newly created files generally only allow attackers
to read the temporary file, but not write to it.
SECURITY-3073 / CVE-2023-43497 (Stapler) & CVE-2023-43498 (MultipartFormDataParser)
In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, uploaded files
processed via the Stapler web framework and the Jenkins API
`MultipartFormDataParser` create temporary files in the system temporary
directory with the default permissions for newly created files.
If these permissions are overly permissive, attackers with access to the
system temporary directory may be able to read and write the file before it
is used.
IMPORTANT: This vulnerability only affects operating systems using a shared
temporary directory for all users (typically Linux). Additionally, the
default permissions for newly created files generally only allow attackers
to read the temporary file, but not write to it.
SECURITY-3244 / CVE-2023-43499
Build Failure Analyzer Plugin 2.4.1 and earlier does not escape Failure
Cause names in build logs.
This results in a stored cross-site scripting (XSS) vulnerability
exploitable by attackers able to create or update Failure Causes.
SECURITY-3226 / CVE-2023-43500 (CSRF) & CVE-2023-43501 (missing permission check)
Build Failure Analyzer Plugin 2.4.1 and earlier does not perform a
permission check in a connection test HTTP endpoint.
This allows attackers with Overall/Read permission to connect to an
attacker-specified hostname and port using attacker-specified username and
password.
Additionally, this HTTP endpoint does not require POST requests, resulting
in a cross-site request forgery (CSRF) vulnerability.
SECURITY-3239 / CVE-2023-43502
Build Failure Analyzer Plugin 2.4.1 and earlier does not require POST
requests for an HTTP endpoint, resulting in a cross-site request forgery
(CSRF) vulnerability.
This vulnerability allows attackers to delete Failure Causes.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
