[<prev] [next>] [day] [month] [year] [list]
Message-Id: <E6F892F6-8CD5-4BDC-8CEB-E43984372B57@beckweb.net>
Date: Thu, 10 Apr 2025 13:16:36 +0200
From: Daniel Beck <ml@...kweb.net>
To: oss-security@...ts.openwall.com
Subject: Vulnerabilities in Jenkins Docker images
Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software.
Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:
https://www.jenkins.io/security/advisory/2025-04-10/
We provide advance notification for security updates on this mailing list:
https://groups.google.com/d/forum/jenkinsci-advisories
If you discover security vulnerabilities in Jenkins, please report them as
described here:
https://www.jenkins.io/security/#reporting-vulnerabilities
---
SECURITY-3565 / CVE-2025-32754 (jenkins/ssh-agent) & CVE-2025-32755 (jenkins/ssh-slave)
The jenkins/ssh-agent and deprecated jenkins/ssh-slave Docker images can be
used to set up a build agent for use via the SSH Build Agents plugin.
In jenkins/ssh-agent 6.11.1 and earlier and all versions of
jenkins/ssh-slave, SSH host keys are generated on image creation for images
based on Debian.
As a result, all containers based on images of the same version use the
same SSH host keys. This allows attackers able to insert themselves into
the network path between the SSH client (typically the Jenkins controller)
and SSH build agent to impersonate the latter.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
