Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 17 Jul 2019 16:25:03 +0200
From: Wadeck Follonier <>
Subject: Multiple vulnerabilities in Jenkins

Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software. The following
releases contain fixes for security vulnerabilities:

* Jenkins weekly 2.186
* Jenkins LTS 2.176.2

Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:

We provide advance notification for security updates on this mailing list:

If you discover security vulnerabilities in Jenkins, please report them as
described here:


SECURITY-1424 / CVE-2019-10352
Users with Job/Configure permission could specify a relative path escaping
the base directory in the file name portion of a file parameter definition.

This path would be used to store the uploaded file on the Jenkins master,
resulting in an arbitrary file write vulnerability.

SECURITY-626 / CVE-2019-10353
By default, CSRF tokens in Jenkins only checked user authentication and IP

This allowed attackers able to obtain a CSRF token for another user to
implement CSRF attacks as long as the victim's IP address remained unchanged.

SECURITY-534 / CVE-2019-10354
Jenkins uses the Stapler web framework to render its UI views.

These views are frequently comprised of several view fragments, enabling
plugins to extend existing views with more content.

In some cases attackers could directly access a view fragment containing
sensitive information, bypassing any permission checks in the corresponding

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.