[<prev] [next>] [day] [month] [year] [list]
Message-Id: <473F72F1-A06B-436D-952A-A04DFE1BA918@beckweb.net>
Date: Wed, 17 Apr 2019 16:40:14 +0200
From: Daniel Beck <ml@...kweb.net>
To: oss-security@...ts.openwall.com
Subject: Multiple vulnerabilities in Jenkins plugins
Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software. The following
releases contain fixes for security vulnerabilities:
* Azure PublisherSettings Credentials Plugin 1.5
* GitLab Plugin 1.5.12
* jira-ext Plugin 0.9
* ontrack Jenkins Plugin 3.4.1
Additionally, these plugin have security vulnerabilities that have been made
public, but have no releases containing a fix yet:
* XebiaLabs XL Deploy Plugin
Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:
https://jenkins.io/security/advisory/2019-04-17/
We provide advance notification for security updates on this mailing list:
https://groups.google.com/d/forum/jenkinsci-advisories
If you discover security vulnerabilities in Jenkins, please report them as
described here:
https://jenkins.io/security/#reporting-vulnerabilities
---
SECURITY-1357 / CVE-2019-10300 (CSRF) and CVE-2019-10301 (permission check)
GitLab Plugin did not perform permission checks on a method implementing
form validation. This allowed users with Overall/Read access to Jenkins to
connect to an attacker-specified URL using attacker-specified credentials
IDs obtained through another method, capturing credentials stored in Jenkins.
Additionally, this form validation method did not require POST requests,
resulting in a cross-site request forgery vulnerability.
SECURITY-836 / CVE-2019-10302
jira-ext Plugin stored credentials unencrypted in its global configuration
file hudson.plugins.jira.JiraProjectProperty.xml on the Jenkins master.
These credentials could be viewed by users with access to the master file
system.
SECURITY-844 / CVE-2019-10303
Azure PublisherSettings Credentials Plugin stored the service management
certificate unencrypted in credentials.xml on the Jenkins master. These
credentials could be viewed by users with access to the master file system.
SECURITY-983 / CVE-2019-10304 (CSRF) and CVE-2019-10305 (permission check)
A missing permission check in a form validation method in XebiaLabs XL
Deploy Plugin allows users with Overall/Read permission to initiate a
connection test to an attacker-specified server with attacker-specified
credentials.
Additionally, the form validation method does not require POST requests,
resulting in a CSRF vulnerability.
SECURITY-1341 / CVE-2019-10306
ontrack Jenkins Plugin supports sandboxed Groovy expressions. Its sandbox
protection could be circumvented during parsing, compilation, and script
instantiation by providing a crafted Groovy script.
This allowed users able to control the plugin’s job-specific configuration
to bypass the sandbox protection and execute arbitrary code on the Jenkins
master.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
