[<prev] [next>] [day] [month] [year] [list]
Message-Id: <C20D6D7D-DE83-4394-941C-F9683ABA6440@beckweb.net>
Date: Thu, 2 May 2024 15:08:13 +0200
From: Daniel Beck <ml@...kweb.net>
To: oss-security@...ts.openwall.com
Subject: Multiple vulnerabilities in Jenkins plugins
Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software.
The following releases contain fixes for security vulnerabilities:
* Git server Plugin 117.veb_68868fa_027
* Script Security Plugin 1336.vf33a_a_9863911
Additionally, we announce unresolved security issues in the following
plugins:
* Subversion Partial Release Manager Plugin
* Telegram Bot Plugin
Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:
https://www.jenkins.io/security/advisory/2024-05-02/
We provide advance notification for security updates on this mailing list:
https://groups.google.com/d/forum/jenkinsci-advisories
If you discover security vulnerabilities in Jenkins, please report them as
described here:
https://www.jenkins.io/security/#reporting-vulnerabilities
---
SECURITY-3341 / CVE-2024-34144 (crafted constructor bodies) & CVE-2024-34145 (sandbox-defined classes)
Script Security Plugin provides a sandbox feature that allows low
privileged users to define scripts, including Pipelines, that are generally
safe to execute. Calls to code defined inside a sandboxed script are
intercepted, and various allowlists are checked to determine whether the
call is to be allowed.
Multiple sandbox bypass vulnerabilities exist in Script Security Plugin
1335.vf07d9ce377a_e and earlier:
* Crafted constructor bodies that invoke other constructors can be used to
construct any subclassable type via implicit casts.
* Sandbox-defined Groovy classes that shadow specific non-sandbox-defined
classes can be used to construct any subclassable type.
These vulnerabilities allow attackers with permission to define and run
sandboxed scripts, including Pipelines, to bypass the sandbox protection
and execute arbitrary code in the context of the Jenkins controller JVM.
SECURITY-3342 / CVE-2024-34146
Git server Plugin 114.v068a_c7cc2574 and earlier does not perform a
permission check for read access to a Git repository over SSH.
This allows attackers with a previously configured SSH public key but
lacking Overall/Read permission to access Git repositories.
SECURITY-3294 / CVE-2024-34147
Telegram Bot Plugin 1.4.0 and earlier stores the Telegram Bot token
unencrypted in its global configuration file
`jenkinsci.plugins.telegrambot.TelegramBotGlobalConfiguration.xml` on the
Jenkins controller as part of its configuration.
This token can be viewed by users with access to the Jenkins controller
file system.
As of publication of this advisory, there is no fix.
SECURITY-3331 / CVE-2024-34148
Subversion Partial Release Manager Plugin 1.0.1 and earlier
programmatically sets the Java system property
`hudson.model.ParametersAction.keepUndefinedParameters` whenever
a build is triggered from a release tag with the 'Svn-Partial
Release Manager' SCM. Doing so disables the fix for SECURITY-170
/ CVE-2016-3721.
As of publication of this advisory, there is no fix.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
