[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <D63A4457-CF66-4203-BBA2-F2D432A2DBE0@beckweb.net>
Date: Mon, 23 Oct 2017 14:20:30 +0200
From: Daniel Beck <ml@...kweb.net>
To: oss-security@...ts.openwall.com
Subject: Multiple vulnerabilities in Jenkins plugins
Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software. The following
plugin releases contain fixes for security vulnerabilities:
* Active Choices (uno-choice) Plugin 2.0
* Build-Publisher Plugin 1.22
* Dependency Graph Viewer Plugin 0.13
* global-build-stats Plugin 1.5
* Multijob Plugin 1.26
Additionally, we announce a vulnerability in SCP publisher plugin without fix.
Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:
https://jenkins.io/security/advisory/2017-10-23/
We provide advance notification for security updates on this mailing list:
https://groups.google.com/d/forum/jenkinsci-advisories
If you find security vulnerabilities in Jenkins, please report them as
described here:
https://jenkins.io/security/#reporting-vulnerabilities
---
SECURITY-470
Active Choices plugin allowed users with Job/Configure permission to
provide arbitrary HTML to be shown on the Build With Parameters page
through the Active Choices Reactive Reference Parameter type. This could
include, for example, arbitrary JavaScript.
SECURITY-50
Some URLs provided by global-build-stats plugin returned a JSON response
that contained request parameters. These responses had the
Content-Type: text/html, so could have been interpreted as HTML by clients,
resulting in a potential reflected cross-site scripting vulnerability.
Additionally, some URLs provided by global-build-stats plugin that modify
data did not require POST requests to be sent, resulting in a potential
cross-site request forgery vulnerability.
SECURITY-57
Dependency Graph Viewer plugin did not perform permission checks for the
API endpoint that modifies the dependency graph, allowing anyone with
Overall/Read permission to modify this data.
SECURITY-374
SCP publisher plugin stores credentials to other Jenkins instances in the
file be.certipost.hudson.plugin.SCPRepositoryPublisher.xml in the Jenkins
master home directory. These credentials are stored unencrypted, allowing
anyone with local file system access to access them.
Additionally, the credentials are also transmitted in plain text as part
of the configuration form. This could result in exposure of the credentials
through browser extensions, cross-site scripting vulnerabilities, and
similar situations.
SECURITY-378
Build-Publisher plugin stores credentials to other Jenkins instances in the
file hudson.plugins.build_publisher.BuildPublisher.xml in the Jenkins
master home directory. These credentials were stored unencrypted, allowing
anyone with local file system access to access them.
Additionally, the credentials were also transmitted in plain text as part
of the configuration form. This could result in exposure of the API key
through browser extensions, cross-site scripting vulnerabilities, and
similar situations.
JENKINS-36333
Multijob plugin did not check permissions in the Resume Build action,
allowing anyone with Job/Read permission to resume the build.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
