[<prev] [next>] [day] [month] [year] [list]
Message-Id: <8A60B212-2A7B-4675-932B-A6DC04A93164@beckweb.net>
Date: Tue, 15 Mar 2022 17:29:37 +0100
From: Daniel Beck <ml@...kweb.net>
To: oss-security@...ts.openwall.com
Subject: Multiple vulnerabilities in Jenkins plugins
Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software.
The following releases contain fixes for security vulnerabilities:
* CloudBees AWS Credentials Plugin 191.vcb_f183ce58b_9
* Dashboard View Plugin 2.18.1
* Favorite Plugin 2.4.1
* Folder-based Authorization Strategy Plugin 1.4
* Parameterized Trigger Plugin 2.43.1
* Semantic Versioning Plugin 1.14
Additionally, we announce unresolved security issues in the following
plugins:
* dbCharts Plugin
* Environment Dashboard Plugin
* Extended Choice Parameter Plugin
* GitLab Authentication Plugin
* global-build-stats Plugin
* incapptic connect uploader Plugin
* Kubernetes Continuous Deploy Plugin
* List Git Branches Parameter Plugin
* Release Helper Plugin
* Vmware vRealize CodeStream Plugin
Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:
https://www.jenkins.io/security/advisory/2022-03-15/
We provide advance notification for security updates on this mailing list:
https://groups.google.com/d/forum/jenkinsci-advisories
If you discover security vulnerabilities in Jenkins, please report them as
described here:
https://www.jenkins.io/security/#reporting-vulnerabilities
---
SECURITY-2185 / CVE-2022-27195
Parameterized Trigger Plugin 2.43 and earlier captures environment
variables passed to builds triggered using Parameterized Trigger Plugin,
including password parameter values, in their `build.xml` files. These
values are stored unencrypted and can be viewed by users with access to the
Jenkins controller file system.
SECURITY-2557 / CVE-2022-27196
Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the
favorite column.
This results in a stored cross-site scripting (XSS) vulnerability
exploitable by attackers with Item/Configure or Item/Create permissions.
SECURITY-2559 / CVE-2022-27197
Dashboard View Plugin 2.18 and earlier does not perform URL validation for
the Iframe Portlet's Iframe source URL.
This results in a stored cross-site scripting (XSS) vulnerability
exploitable by attackers able to configure views.
SECURITY-2351 / CVE-2022-27198 (CSRF) & CVE-2022-27199 (permission check)
CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier does not
perform a permission check in a method implementing form validation.
This allows attackers with Overall/Read permission to connect to an AWS
service using an attacker-specified token.
Additionally, this form validation method does not require POST requests,
resulting in a cross-site request forgery (CSRF) vulnerability.
SECURITY-2646 / CVE-2022-27200
Folder-based Authorization Strategy Plugin 1.3 and earlier does not escape
the names of roles shown on the configuration form.
This results in a stored cross-site scripting (XSS) vulnerability
exploitable by attackers with Overall/Administer permission.
SECURITY-2124 / CVE-2022-27201
Semantic Versioning Plugin defines a controller/agent message that
processes a given file as XML and returns version information. The XML
parser is not configured to prevent XML external entity (XXE) attacks,
which is only a problem if XML documents are parsed on the Jenkins
controller.
Semantic Versioning Plugin 1.13 and earlier does not restrict execution of
the controller/agent message to agents, and implements no limitations about
the file path that can be parsed. This allows attackers able to control
agent processes to have Jenkins parse a crafted file that uses external
entities for extraction of secrets from the Jenkins controller or
server-side request forgery.
SECURITY-2232 / CVE-2022-27202
Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not
escape the value and description of Extended Choice Parameters with
parameter type 'Radio Buttons' or 'Check Boxes'.
This results in a stored cross-site scripting (XSS) vulnerability
exploitable by attackers with Item/Configure permission.
As of publication of this advisory, there is no fix.
SECURITY-1351 / CVE-2022-27203
Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows
attackers with Item/Configure permission to read values from arbitrary JSON
and Java properties files on the Jenkins controller.
As of publication of this advisory, there is no fix.
SECURITY-1350 / CVE-2022-27204 (CSRF) & CVE-2022-27205 (permission check)
Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not
perform a permission check on form validation methods. This allows
attackers with Overall/Read permission to connect to an attacker-specified
URL.
Additionally, these form validation methods do not require POST requests,
resulting in a cross-site request forgery (CSRF) vulnerability.
As of publication of this advisory, there is no fix.
SECURITY-1891 / CVE-2022-27206
GitLab Authentication Plugin 1.13 and earlier stores the GitLab client
secret unencrypted in the global `config.xml` file on the Jenkins
controller as part of its configuration.
This client secret can be viewed by users with access to the Jenkins
controller file system.
As of publication of this advisory, there is no fix.
SECURITY-1886 / CVE-2022-27207
global-build-stats Plugin 1.5 and earlier does not escape multiple fields
in the chart configuration on the 'Global Build Stats' page.
This results in a stored cross-site scripting (XSS) vulnerability
exploitable by attackers with Overall/Administer permission.
As of publication of this advisory, there is no fix.
SECURITY-2096 / CVE-2022-27208
Kubernetes Continuous Deploy Plugin contributes the 'Kubernetes
configuration (kubeconfig)' credential type.
Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows users with
Credentials/Create or Credentials/Update permission to read arbitrary files
on the Jenkins controller by defining a 'From a file on the Jenkins master'
Kubeconfig source for such a credential.
As of publication of this advisory, there is no fix.
SECURITY-2636 / CVE-2022-27209
Kubernetes Continuous Deploy Plugin 2.3.1 and earlier does not perform
permission checks in several HTTP endpoints.
This allows attackers with Overall/Read permission to enumerate credentials
IDs of credentials stored in Jenkins. Those can be used as part of an
attack to capture the credentials using another vulnerability.
As of publication of this advisory, there is no fix.
SECURITY-2681 / CVE-2022-27210 (CSRF) & CVE-2022-27211 (permission check)
Kubernetes Continuous Deploy Plugin 2.3.1 and earlier does not perform a
permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to connect to an
attacker-specified SSH server using attacker-specified credentials IDs
obtained through another method, capturing credentials stored in Jenkins.
Additionally, this endpoint does not require POST requests, resulting in a
cross-site request forgery (CSRF) vulnerability.
As of publication of this advisory, there is no fix.
SECURITY-2167 / CVE-2022-27212
List Git Branches Parameter Plugin 0.0.9 and earlier does not escape the
name or default value of the 'List Git branches (and more)' parameter.
Additionally, List Git Branches Parameter Plugin explicitly disables a
protection mechanism introduced in Jenkins 2.44 and LTS 2.32.2 to prevent
exploitation of unescaped parameter names.
This results in a stored cross-site scripting (XSS) vulnerability
exploitable by attackers with Item/Configure permission.
As of publication of this advisory, there is no fix.
SECURITY-2252 / CVE-2022-27213
Environment Dashboard Plugin 1.1.10 and earlier does not escape the
Environment order and the Component order configuration values in its
views.
This results in a stored cross-site scripting (XSS) vulnerability
exploitable by attackers with View/Configure permission.
As of publication of this advisory, there is no fix.
SECURITY-2274 / CVE-2022-27214 (CSRF) & CVE-2022-27215 (permission check)
Release Helper Plugin 1.3.3 and earlier does not perform a permission check
in a method implementing form validation.
This allows attackers with Overall/Read permission to connect to an
attacker-specified URL using attacker-specified username and password.
Additionally, this form validation method does not require POST requests,
resulting in a cross-site request forgery (CSRF) vulnerability.
As of publication of this advisory, there is no fix.
SECURITY-2159 / CVE-2022-27216
dbCharts Plugin 0.5.2 and earlier stores JDBC connection passwords
unencrypted in its global configuration file
`hudson.plugins.dbcharts.DbChartPublisher.xml` on the Jenkins controller as
part of its configuration.
These passwords can be viewed by users with access to the Jenkins
controller file system.
As of publication of this advisory, there is no fix.
SECURITY-2238 / CVE-2022-27217
Vmware vRealize CodeStream Plugin 1.2 and earlier stores passwords
unencrypted in job `config.xml` files on the Jenkins controller as part of
its configuration.
These passwords can be viewed by users with Item/Extended Read permission
or access to the Jenkins controller file system.
As of publication of this advisory, there is no fix.
SECURITY-2273 / CVE-2022-27218
incapptic connect uploader Plugin 1.15 and earlier stores personal tokens
unencrypted in job `config.xml` files on the Jenkins controller as part of
its configuration.
These tokens can be viewed by users with Item/Extended Read permission or
access to the Jenkins controller file system.
As of publication of this advisory, there is no fix.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
