[<prev] [next>] [day] [month] [year] [list]
Message-Id: <CC6AAEF3-55C7-4F5F-9664-624DFE79A227@beckweb.net>
Date: Wed, 12 Aug 2020 15:20:24 +0200
From: Daniel Beck <ml@...kweb.net>
To: oss-security@...ts.openwall.com
Subject: Multiple vulnerabilities in Jenkins and Jenkins plugins
Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software.
The following releases contain fixes for security vulnerabilities:
* Jenkins 2.252
* Jenkins LTS 2.235.4
* Email Extension Plugin 2.74
* Pipeline Maven Integration Plugin 3.8.3
* Yet Another Build Visualizer Plugin 1.12
Additionally, we announce unresolved security issues in the following
plugins:
* Flaky Test Handler Plugin
Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:
https://www.jenkins.io/security/advisory/2020-08-12/
We provide advance notification for security updates on this mailing list:
https://groups.google.com/d/forum/jenkinsci-advisories
If you discover security vulnerabilities in Jenkins, please report them as
described here:
https://www.jenkins.io/security/#reporting-vulnerabilities
---
SECURITY-1955 / CVE-2020-2229
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the
tooltip content of help icons. Tooltip values can be contributed by
plugins, some of which use user-specified values.
This results in a stored cross-site scripting (XSS) vulnerability.
SECURITY-1957 / CVE-2020-2230
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the
project naming strategy description that is displayed on item creation.
This results in a stored cross-site scripting (XSS) vulnerability
exploitable by users with Overall/Manage permission.
SECURITY-1960 / CVE-2020-2231
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the
remote address of the host starting a build via 'Trigger builds remotely'.
This results in a stored cross-site scripting (XSS) vulnerability
exploitable by users with Job/Configure permission or knowledge of the
Authentication Token.
SECURITY-1975 / CVE-2020-2232
Email Extension Plugin stores an SMTP password in its global configuration
file `hudson.plugins.emailext.ExtendedEmailPublisher.xml` on the Jenkins
master as part of its configuration.
While this password is stored encrypted on disk, it is transmitted and
displayed in plain text as part of the configuration form by Email
Extension Plugin 2.72 and 2.73. This can result in exposure of the
password.
SECURITY-1794 (1) / CVE-2020-2233
Pipeline Maven Integration Plugin 3.8.2 and earlier does not perform a
permission check in an HTTP endpoint.
This allows attackers with Overall/Read access to Jenkins to enumerate
credentials IDs of credentials stored in Jenkins. Those can be used as part
of an attack to capture the credentials using another vulnerability.
SECURITY-1794 (2) / CVE-2020-2234 (permission check) & CVE-2020-2235 (CSRF)
Pipeline Maven Integration Plugin 3.8.2 and earlier does not perform a
permission check in a method implementing form validation.
This allows users with Overall/Read access to Jenkins to connect to an
attacker-specified JDBC URL using attacker-specified credentials IDs
obtained through another method, potentially capturing credentials stored
in Jenkins.
Additionally, this form validation method does not require POST requests,
resulting in a cross-site request forgery (CSRF) vulnerability.
SECURITY-1940 / CVE-2020-2236
Yet Another Build Visualizer Plugin 1.11 and earlier does not escape
tooltip content.
This results in a stored cross-site scripting (XSS) vulnerability
exploitable by users with Run/Update permission.
SECURITY-1763 / CVE-2020-2237
Flaky Test Handler Plugin 1.0.4 and earlier does not require POST requests
for the "Deflake this build" feature, resulting in a cross-site request
forgery (CSRF) vulnerability.
This vulnerability allows attackers to rebuild a project at a previous git
revision where the tests were failing.
As of publication of this advisory, there is no fix.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
