[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAKG2iZgXKEhr1_MQ1z9PxE=Q9hJ+fdGDm=CckapoGuUYb47Gxw@mail.gmail.com>
Date: Wed, 2 Apr 2025 15:58:23 +0200
From: Kevin Guerroudj <kguerroudj@...udbees.com>
To: oss-security@...ts.openwall.com
Subject: Multiple vulnerabilities in Jenkins and Jenkins plugins
Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software.
The following releases contain fixes for security vulnerabilities:
* Jenkins 2.504
* Jenkins LTS 2.492.3
* Cadence vManager Plugin 4.0.1-286.v9e25a_740b_a_48
* Simple Queue Plugin 1.4.7
* Templating Engine Plugin 2.5.4
Additionally, we announce unresolved security issues in the following
plugins:
* AsakusaSatellite Plugin
* monitor-remote-job Plugin
* Stack Hammer Plugin
Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:
https://www.jenkins.io/security/advisory/2025-04-02/
We provide advance notification for security updates on this mailing list:
https://groups.google.com/d/forum/jenkinsci-advisories
If you discover security vulnerabilities in Jenkins, please report them as
described here:
https://www.jenkins.io/security/#reporting-vulnerabilities
---
SECURITY-3512 / CVE-2025-31720
Jenkins 2.503 and earlier, LTS 2.492.2 and earlier does not perform a
permission check in an HTTP endpoint.
This allows attackers with Computer/Create permission but without
Computer/Extended Read permission to copy an agent, gaining access to its
configuration.
SECURITY-3513 / CVE-2025-31721
Jenkins 2.503 and earlier, LTS 2.492.2 and earlier does not perform a
permission check in an HTTP endpoint.
This allows attackers with Computer/Create permission but without
Computer/Configure permission to copy an agent, gaining access to encrypted
secrets in its configuration.
SECURITY-3505 / CVE-2025-31722
Templating Engine Plugin allows defining libraries both in the global
configuration, as well as scoped to folders containing the pipelines using
them. While libraries in the global configuration can only be set up by
administrators and can therefore be trusted, libraries defined in folders
can be configured by users with Item/Configure permission.
In Templating Engine Plugin 2.5.3 and earlier, libraries defined in folders
are not subject to sandbox protection. This vulnerability allows attackers
with Item/Configure permission to execute arbitrary code in the context of
the Jenkins controller JVM.
SECURITY-3469 / CVE-2025-31723
Simple Queue Plugin 1.4.6 and earlier does not require POST requests for
multiple HTTP endpoints, resulting in cross-site request forgery (CSRF)
vulnerabilities.
These vulnerabilities allow attackers to change and reset the build queue
order.
SECURITY-3537 / CVE-2025-31724
Cadence vManager Plugin 4.0.0-282.v5096a_c2db_275 and earlier stores
Verisium Manager vAPI keys unencrypted in job `config.xml` files on the
Jenkins controller as part of its configuration.
These API keys can be viewed by users with Item/Extended Read permission or
access to the Jenkins controller file system.
SECURITY-3539 / CVE-2025-31725
monitor-remote-job Plugin 1.0 stores passwords unencrypted in job
`config.xml` files on the Jenkins controller as part of its configuration.
These passwords can be viewed by users with Item/Extended Read permission
or access to the Jenkins controller file system.
As of publication of this advisory, there is no fix.
SECURITY-3520 / CVE-2025-31726
Stack Hammer Plugin 1.0.6 and earlier stores Stack Hammer API keys
unencrypted in job `config.xml` files on the Jenkins controller as part of
its configuration.
These API keys can be viewed by users with Item/Extended Read permission or
access to the Jenkins controller file system.
As of publication of this advisory, there is no fix.
SECURITY-3523 / CVE-2025-31727 (storage) & CVE-2025-31728 (masking)
AsakusaSatellite Plugin 0.1.1 and earlier stores AsakusaSatellite API keys
unencrypted in job `config.xml` files on the Jenkins controller as part of
its configuration.
These API keys can be viewed by users with Item/Extended Read permission or
access to the Jenkins controller file system.
Additionally, the job configuration form does not mask these API keys,
increasing the potential for attackers to observe and capture them.
As of publication of this advisory, there is no fix.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
