[<prev] [next>] [day] [month] [year] [list]
Message-Id: <2EAAFD2D-2302-40AF-84DB-5DA8E46A40B2@beckweb.net>
Date: Wed, 6 May 2020 14:32:27 +0200
From: Daniel Beck <ml@...kweb.net>
To: oss-security@...ts.openwall.com
Subject: Multiple vulnerabilities in Jenkins plugins
Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software.
The following releases contain fixes for security vulnerabilities:
* Amazon EC2 Plugin 1.50.2
* Copy Artifact Plugin 1.44
* Credentials Binding Plugin 1.23
* CVS Plugin 2.16
* SCM Filter Jervis Plugin 0.3
Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:
https://jenkins.io/security/advisory/2020-05-06/?
We provide advance notification for security updates on this mailing list:
https://groups.google.com/d/forum/jenkinsci-advisories
If you discover security vulnerabilities in Jenkins, please report them as
described here:
https://jenkins.io/security/#reporting-vulnerabilities
---
SECURITY-1374 / CVE-2020-2181
Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace
with asterisks) secrets in the build log when the build contains no build
steps.
SECURITY-1835 / CVE-2020-2182
Credentials Binding Plugin allows specifying passwords and other secrets as
environment variables, and will hide them from console output in builds. As
a side effect of the fix for SECURITY-698, `$` characters in secrets are
escaped to `$$`. This will then be expanded to `$` again once the secret is
passed to (post) build steps.
Credentials Binding Plugin 1.22 and earlier does not mask the escaped form
of the secret (containing `$$`). This occurs for example in the "Execute
Maven top-level targets" build step included in Jenkins.
SECURITY-988 / CVE-2020-2183
Copy Artifact Plugin 1.43.1 and earlier performs improper permission checks
when determining whether a build can copy artifacts from another project
build. This allows attackers, usually with Job/Configure permission, to
configure jobs to copy artifacts from jobs they have no permission to
access.
SECURITY-1094 / CVE-2020-2184
CVS Plugin 2.15 and earlier does not require POST requests in several HTTP
endpoints, resulting in cross-site request forgery (CSRF) vulnerabilities.
This allows attackers to create and manipulate tags, and to connect to an
attacker-specified URL.
SECURITY-381 / CVE-2020-2185
Amazon EC2 Plugin 1.50.1 and earlier does not use SSH host key validation
when connecting to agents. This lack of validation could be abused using a
man-in-the-middle attack to intercept these connections to build agents.
SECURITY-1408 / CVE-2020-2186
Amazon EC2 Plugin 1.50.1 and earlier does not require POST requests in
several HTTP endpoints, resulting in cross-site request forgery (CSRF)
vulnerabilities. This allows an attacker to provision instances with an
attacker-specified template ID.
SECURITY-1528 / CVE-2020-2187
Amazon EC2 Plugin connects to Windows agents via HTTPS.
Amazon EC2 Plugin 1.50.1 and earlier unconditionally accepts self-signed
HTTPS certificates and does not perform hostname validation when connecting
to Windows agents. This lack of validation could be abused using a
man-in-the-middle attack to intercept these connections to build agents.
SECURITY-1844 / CVE-2020-2188
Amazon EC2 Plugin provides a list of applicable credentials IDs to allow
users configuring the plugin to select the one to use.
This functionality does not correctly check permissions in Amazon EC2
Plugin 1.50.1 and earlier, allowing any user with Overall/Read permission
to get a list of valid credentials IDs. Those can be used as part of an
attack to capture the credentials using another vulnerability.
SECURITY-1826 / CVE-2020-2189
SCM Filter Jervis Plugin 0.2.1 and earlier does not configure its YAML
parser to prevent the instantiation of arbitrary types. This results in a
remote code execution (RCE) vulnerability exploitable by users able to
configure jobs with the filter, or control the contents of a previously
configured job's SCM repository.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
