[<prev] [next>] [day] [month] [year] [list]
Message-Id: <CFB3E269-B6B5-4497-A131-75FF0887E890@beckweb.net>
Date: Wed, 2 Oct 2024 15:39:46 +0200
From: Daniel Beck <ml@...kweb.net>
To: oss-security@...ts.openwall.com
Subject: Multiple vulnerabilities in Jenkins and Jenkins plugins
Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software.
The following releases contain fixes for security vulnerabilities:
* Jenkins 2.479
* Jenkins LTS 2.462.3
* Credentials Plugin 1381.v2c3a_12074da_b_
* OpenId Connect Authentication Plugin 4.355.v3a_fb_fca_b_96d4
Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:
https://www.jenkins.io/security/advisory/2024-10-02/
We provide advance notification for security updates on this mailing list:
https://groups.google.com/d/forum/jenkinsci-advisories
If you discover security vulnerabilities in Jenkins, please report them as
described here:
https://www.jenkins.io/security/#reporting-vulnerabilities
---
SECURITY-3451 / CVE-2024-47803
Jenkins provides the `secretTextarea` form field for multi-line secrets.
Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact
multi-line secret values in error messages generated for form submissions
involving the `secretTextarea` form field.
This can result in exposure of multi-line secrets through those error
messages, e.g., in the system log.
SECURITY-3448 / CVE-2024-47804
Jenkins provides APIs for fine-grained control of item creation:
* Authorization strategies can prohibit the creation of items of a given
type in a given item group.
* Item types can prohibit creation of new instances in a given item group.
If an attempt is made to create an item of a prohibited type through the
Jenkins CLI or the REST API and either of the above checks fail, Jenkins
2.478 and earlier, LTS 2.462.2 and earlier creates the item in memory, only
deleting it from disk.
This allows attackers with Item/Create permission to bypass these
restrictions, creating a temporary item. With Item/Configure permission,
they can also save the item to persist it.
SECURITY-3373 / CVE-2024-47805
Credentials Plugin 1380.va_435002fa_924 and earlier, except
1371.1373.v4eb_fa_b_7161e9, does not redact encrypted values of credentials
using the `SecretBytes` type (e.g., Certificate credentials, or Secret file
credentials from Plain Credentials Plugin) when accessing item `config.xml`
via REST API or CLI.
This allows attackers with Item/Extended Read permission to view encrypted
`SecretBytes` values in credentials.
SECURITY-3441 (1) / CVE-2024-47806
OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does
not check the `aud` (Audience) claim of an ID Token during its
authentication flow, a value to verify the token is issued for the correct
client.
This vulnerability may allow attackers to subvert the authentication flow,
potentially gaining administrator access to Jenkins.
SECURITY-3441 (2) / CVE-2024-47807
OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does
not check the `iss` (Issuer) claim of an ID Token during its authentication
flow, a value that identifies the Originating Party (IdP).
This vulnerability may allow attackers to subvert the authentication flow,
potentially gaining administrator access to Jenkins.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
