[<prev] [next>] [day] [month] [year] [list]
Message-Id: <8100C957-0EFB-4A6F-98B2-5DB4544CA6F1@beckweb.net>
Date: Wed, 29 Nov 2023 14:33:15 +0100
From: Daniel Beck <ml@...kweb.net>
To: oss-security@...ts.openwall.com
Subject: Multiple vulnerabilities in Jenkins plugins
Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software.
The following releases contain fixes for security vulnerabilities:
* Google Compute Engine Plugin 4.551.v5a_4dc98f6962
* Jira Plugin 3.12
* MATLAB Plugin 2.11.1
* NeuVector Vulnerability Scanner Plugin 2.2
Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:
https://www.jenkins.io/security/advisory/2023-11-29/
We provide advance notification for security updates on this mailing list:
https://groups.google.com/d/forum/jenkinsci-advisories
If you discover security vulnerabilities in Jenkins, please report them as
described here:
https://www.jenkins.io/security/#reporting-vulnerabilities
---
SECURITY-3225 / CVE-2023-49653
Jira Plugin 3.11 and earlier does not set the appropriate context for
credentials lookup, allowing the use of system-scoped credentials otherwise
reserved for the global configuration.
This allows attackers with Item/Configure permission to access and capture
credentials they are not entitled to.
SECURITY-2835 / CVE-2023-49652
Google Compute Engine Plugin 4.550.vb_327fca_3db_11 and earlier does not
correctly perform permission checks in multiple HTTP endpoints. This allows
attackers with global Item/Configure permission (while lacking
Item/Configure permission on any particular job) to do the following:
* Enumerate system-scoped credentials IDs of credentials stored in Jenkins.
Those can be used as part of an attack to capture the credentials using
another vulnerability.
* Connect to Google Cloud Platform using attacker-specified credentials IDs
obtained through another method, to obtain information about existing
projects.
SECURITY-3193 / CVE-2023-49654 (permission checks) & CVE-2023-49655 (CSRF) & CVE-2023-49656 (XXE)
MATLAB Plugin determines whether a user-specified directory on the Jenkins
controller is the location of a MATLAB installation by parsing an XML file
in that directory.
MATLAB Plugin 2.11.0 and earlier does not perform permission checks in
several HTTP endpoints implementing related form validation.
Additionally, these HTTP endpoints do not require POST requests, resulting
in a cross-site request forgery (CSRF) vulnerability.
Additionally, the plugin does not configure its XML parser to prevent XML
external entity (XXE) attacks. This allows attackers able to create files
on the Jenkins controller file system to have Jenkins parse a crafted XML
document that uses external entities for extraction of secrets from the
Jenkins controller or server-side request forgery.
SECURITY-3256 / CVE-2023-49673 (CSRF) & CVE-2023-49674 (missing permission check)
NeuVector Vulnerability Scanner Plugin 1.22 and earlier does not perform a
permission check in a connection test HTTP endpoint. This allows attackers
with Overall/Read permission to connect to an attacker-specified hostname
and port using attacker-specified username and password. Additionally, this
HTTP endpoint does not require POST requests, resulting in a cross-site
request forgery (CSRF) vulnerability.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
