[<prev] [next>] [day] [month] [year] [list]
Message-Id: <B1DBF10E-2BE4-44BA-AD8C-431524FEA766@beckweb.net>
Date: Wed, 7 Dec 2022 14:22:36 +0100
From: Daniel Beck <ml@...kweb.net>
To: oss-security@...ts.openwall.com
Subject: Multiple vulnerabilities in Jenkins plugins
Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software.
The following releases contain fixes for security vulnerabilities:
* Checkmarx Plugin 2022.4.3
* Custom Build Properties Plugin 2.82.v16d5b_d3590c7
* Gitea Plugin 1.4.5
* Google Login Plugin 1.7
* Plot Plugin 2.1.12
* Spring Config Plugin 2.0.1
Additionally, we announce unresolved security issues in the following
plugins:
* Sonar Gerrit Plugin
Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:
https://www.jenkins.io/security/advisory/2022-12-07/
We provide advance notification for security updates on this mailing list:
https://groups.google.com/d/forum/jenkinsci-advisories
If you discover security vulnerabilities in Jenkins, please report them as
described here:
https://www.jenkins.io/security/#reporting-vulnerabilities
---
SECURITY-2940 / CVE-2022-46682
Plot Plugin 2.1.11 and earlier does not configure its XML parser to prevent
XML external entity (XXE) attacks.
This allows attackers able to control XML input files for the 'Plot build
data' build step to have Jenkins parse a crafted file that uses external
entities for extraction of secrets from the Jenkins controller or
server-side request forgery.
SECURITY-2967 / CVE-2022-46683
Google Login Plugin 1.4 through 1.6 (both inclusive) improperly determines
that a redirect URL after login is legitimately pointing to Jenkins.
This allows attackers to perform phishing attacks by having users go to a
Jenkins URL that will forward them to a different site after successful
authentication.
SECURITY-2869 / CVE-2022-46684
Checkmarx Plugin processes Checkmarx service API responses and generates
HTML reports from them for rendering on the Jenkins UI.
Checkmarx Plugin 2022.3.3 and earlier does not escape values returned from
the Checkmarx service API before inserting them into HTML reports. This
results in a stored cross-site scripting (XSS) vulnerability.
SECURITY-2661 / CVE-2022-46685
Gitea Plugin support authentication with Gitea personal access tokens.
In Gitea Plugin 1.4.4 and earlier, the implementation of these tokens did
not support credentials masking. This can expose Gitea personal access
tokens in the build log, e.g., when printed as part of repository URLs.
SECURITY-2810 / CVE-2022-46686
Custom Build Properties Plugin 2.79.vc095ccc85094 and earlier does not
escape property values or build display names on the Custom Build
Properties page.
This results in a stored cross-site scripting (XSS) vulnerability
exploitable by attackers able to set or change these values.
SECURITY-2814 / CVE-2022-46687
Spring Config Plugin 2.0.0 and earlier does not escape build display names
shown on the Spring Config view.
This results in a stored cross-site scripting (XSS) vulnerability
exploitable by attackers able to change build display names.
SECURITY-1002 / CVE-2022-46688
Sonar Gerrit Plugin 377.v8f3808963dc5 and earlier does not require POST
requests for an HTTP endpoint, resulting in a cross-site request forgery
(CSRF) vulnerability.
This allows attackers to have Jenkins connect to Gerrit servers (previously
configured by Jenkins administrators) using attacker-specified credentials
IDs obtained through another method, potentially capturing credentials
stored in Jenkins.
As of publication of this advisory, there is no fix.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
