[<prev] [next>] [day] [month] [year] [list]
Message-Id: <60EF1721-9E02-481D-9A2D-204F87D75282@beckweb.net>
Date: Tue, 21 Mar 2017 02:19:41 +0100
From: Daniel Beck <ml@...kweb.net>
To: oss-security@...ts.openwall.com
Subject: Jenkins plugins -- multiple vulnerabilities
Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software. The following
plugin releases published today contain fixes for security vulnerabilities:
- Active Directory 2.3
- DistFork Plugin 1.6.0
- Email Extension (email-ext) 2.57.1
- Mailer Plugin 1.20
- SSH Slaves 1.15
Users of these plugins should upgrade them to the indicated versions.
Additionally, one plugin was removed from distribution as there are no plans
to fix its vulnerability, and there are adequate alternatives:
- Pipeline: Classpath Step
Summary and description of the vulnerabilities are below. Some more details,
severity, and attribution can be found here:
https://jenkins.io/security/advisory/2017-03-20/
We provide advance notification for security updates on this mailing list:
https://groups.google.com/d/forum/jenkinsci-advisories
If you find security vulnerabilities in Jenkins, please report them as
described here:
https://jenkins.io/security/#reporting-vulnerabilities
---
SECURITY-161 / CVE-2017-2648
SSH Slaves Plugin did not verify host keys of hosts it connected to.
SECURITY-251 / CVE-2017-2649
Active Directory Plugin did not verify TLS certificate of AD server.
SECURITY-336 / CVE-2017-2650
Pipeline: Classpath Step plugin allows Script Security sandbox bypass for
users with SCM commit access, as well as users with e.g. Job/Configure
permission in Jenkins.
SECURITY-372 / CVE-2017-2651 (Mailer)
SECURITY-372 / CVE-2017-2654 (Email Extension)
Emails could be sent to addresses not associated with actual users of Jenkins
by Mailer Plugin and Email Extension Plugin if they were configured to send
notifications to a dynamically created list of users based on SCM changes. In
rare cases this even resulted in emails sent to people who were not involved
in whatever project was being built.
SECURITY-386 / CVE-2017-2652
There were no permission checks performed in the Distributed Fork plugin
beyond the basic check for Overall/Read permission, allowing anyone with that
permission to run arbitrary shell commands on all connected nodes.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
