[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <B9DFA5CD-50A7-4C49-B93A-64555FBAF031@beckweb.net>
Date: Mon, 25 Mar 2019 16:09:16 +0100
From: Daniel Beck <ml@...kweb.net>
To: oss-security@...ts.openwall.com
Subject: Multiple vulnerabilities in Jenkins plugins
Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software. The following
releases contain fixes for security vulnerabilities:
* Arxan MAM Publisher Plugin 2.2
* Codebeamer Test Results Trend Updater Plugin 1.1.4
* ECS publisher 1.0.1
* Fortify on Demand Uploader Plugin 3.0.11
* Lockable Resources Plugin 2.5
* Pipeline: Groovy Plugin 2.65
* PRQA Plugin 3.1.2
* Script Security Plugin 1.56
* Slack Plugin 2.20
Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:
https://jenkins.io/security/advisory/2019-03-25/
We provide advance notification for security updates on this mailing list:
https://groups.google.com/d/forum/jenkinsci-advisories
If you discover security vulnerabilities in Jenkins, please report them as
described here:
https://jenkins.io/security/#reporting-vulnerabilities
---
SECURITY-1353
Sandbox projection in the Script Security and Pipeline: Groovy Plugins
could be circumvented through methods supporting type casts and type
coercion. This allowed attackers to invoke constructors for arbitrary types.
SECURITY-1361
Lockable Resources Plugin did not properly escape resource names in
generated JavaScript code, thus leading to a cross-site scripting (XSS)
vulnerability.
SECURITY-976
Notification Plugin Plugin did not perform permission checks on a method
implementing form validation. This allowed users with Overall/Read access
to Jenkins to connect to an attacker-specified URL using attacker-specified
credentials IDs obtained through another method, capturing credentials
stored in Jenkins.
Additionally, this form validation method did not require POST requests,
resulting in a cross-site request forgery vulnerability.
SECURITY-846
ECS Publisher Plugin stored the API token unencrypted in jobs' config.xml
files and its global configuration file on the Jenkins master. This token
could be viewed by users with Extended Read permission, or access to the
master file system.
Additionally, the API token was not masked from view using a password form
field.
SECURITY-992
A missing permission check in multiple form validation methods in Fortify
on Demand Uploader Plugin allowed users with Overall/Read permission to
initiate a connection test to an attacker-specified server.
Additionally, the form validation methods did not require POST requests,
resulting in a CSRF vulnerability.
SECURITY-1089
PRQA Plugin stored a password unencrypted in its global configuration file
on the Jenkins master. This password could be viewed by users with access
to the master file system.
SECURITY-1086
Codebeamer Test Results Trend Updater Plugin stored username and password
in its configuration unencrypted in jobs' config.xml files on the Jenkins
master. This password could be viewed by users with Extended Read
permission, or access to the master file system.
SECURITY-1328
Arxan MAM Publisher Plugin provides a list of applicable credential IDs to
allow administrators configuring the plugin to select the one to use.
This functionality did not check permissions, allowing any user with
Overall/Read permission to get a list of valid credentials IDs. Those could
be used as part of an attack to capture the credentials using another
vulnerability.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
