[<prev] [day] [month] [year] [list]
Message-Id: <698004C5-840F-4FDD-AA4B-320FDEBD966D@beckweb.net>
Date: Wed, 27 Nov 2024 17:38:48 +0100
From: Daniel Beck <ml@...kweb.net>
To: oss-security@...ts.openwall.com
Subject: Multiple vulnerabilities in Jenkins and Jenkins plugins
Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software.
The following releases contain fixes for security vulnerabilities:
* Jenkins 2.487
* Jenkins LTS 2.479.2
* Filesystem List Parameter Plugin 0.0.15
* Simple Queue Plugin 1.4.5
Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:
https://www.jenkins.io/security/advisory/2024-11-27/
We provide advance notification for security updates on this mailing list:
https://groups.google.com/d/forum/jenkinsci-advisories
If you discover security vulnerabilities in Jenkins, please report them as
described here:
https://www.jenkins.io/security/#reporting-vulnerabilities
---
SECURITY-3463 / CVE-2024-47855
Jenkins uses the library org.kohsuke.stapler:json-lib to process JSON.
This library is the Jenkins project's fork of net.sf.json-lib:json-lib,
which has since been renamed to org.kordamp.json:json-lib-core.
Jenkins LTS 2.479.1 and earlier, 2.486 and earlier bundles
org.kohsuke.stapler:json-lib 2.4-jenkins-7 or earlier. These releases are
affected by CVE-2024-47855.
In Jenkins (without plugins) this allows attackers with Overall/Read
permission to keep HTTP requests handling threads busy indefinitely, using
system resources and preventing legitimate users from using Jenkins.
Additionally, the Jenkins security team has identified multiple plugins
that allow attackers lacking Overall/Read permission to do the same. These
plugins include SonarQube Scanner and Bitbucket. Additionally, other
features of Jenkins or plugins that process user-provided JSON may be
affected, resulting in those features being blocked.
SECURITY-3467 / CVE-2024-54003
Simple Queue Plugin 1.4.4 and earlier does not escape the view name.
This results in a stored cross-site scripting (XSS) vulnerability
exploitable by attackers with View/Create permission.
SECURITY-3367 / CVE-2024-54004
Filesystem List Parameter Plugin 0.0.14 and earlier does not restrict the
path used for the File system objects list Parameter.
This allows attackers with Item/Configure permission to enumerate file
names on the Jenkins controller file system.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
