[<prev] [next>] [day] [month] [year] [list]
Message-Id: <E80810A1-A473-4C59-85CA-6E1C392E92BA@beckweb.net>
Date: Wed, 26 Jun 2024 18:52:33 +0200
From: Daniel Beck <ml@...kweb.net>
To: oss-security@...ts.openwall.com
Subject: Multiple vulnerabilities in Jenkins plugins
Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software.
The following releases contain fixes for security vulnerabilities:
* Bitbucket Branch Source Plugin 887.va_d359b_3d2d8d
* Plain Credentials Plugin 183.va_de8f1dd5a_2b_
* Structs Plugin 338.v848422169819
Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:
https://www.jenkins.io/security/advisory/2024-06-26/
We provide advance notification for security updates on this mailing list:
https://groups.google.com/d/forum/jenkinsci-advisories
If you discover security vulnerabilities in Jenkins, please report them as
described here:
https://www.jenkins.io/security/#reporting-vulnerabilities
---
SECURITY-3371 / CVE-2024-39458
When Structs Plugin 337.v1b_04ea_4df7c8 and earlier fails to configure a
build step, it logs a warning message containing diagnostic information
that may contain secrets passed as step parameters.
This can result in accidental exposure of secrets through the default
system log.
SECURITY-2495 / CVE-2024-39459
When creating secret file credentials Plain Credentials Plugin
182.v468b_97b_9dcb_8 and earlier attempts to decrypt the content of the
file to check if it constitutes a valid encrypted secret. In rare cases the
file content matches the expected format of an encrypted secret, and the
file content will be stored unencrypted (only Base64 encoded) on the
Jenkins controller file system.
These credentials can be viewed by users with access to the Jenkins
controller file system (global credentials) or with Item/Extended Read
permission (folder-scoped credentials).
NOTE: Secret file credentials stored unencrypted are unusable, as they
would be decrypted during their use. Any successfully used secret file
credentials are therefore unaffected.
SECURITY-3363 / CVE-2024-39460
Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the
Bitbucket OAuth access token as part of the Bitbucket URL in the build log
in some cases.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
