Date: Tue, 21 Mar 2017 02:19:41 +0100 From: Daniel Beck <ml@...kweb.net> To: oss-security@...ts.openwall.com Subject: Jenkins plugins -- multiple vulnerabilities Jenkins is an open source automation server which enables developers around the world to reliably build, test, and deploy their software. The following plugin releases published today contain fixes for security vulnerabilities: - Active Directory 2.3 - DistFork Plugin 1.6.0 - Email Extension (email-ext) 2.57.1 - Mailer Plugin 1.20 - SSH Slaves 1.15 Users of these plugins should upgrade them to the indicated versions. Additionally, one plugin was removed from distribution as there are no plans to fix its vulnerability, and there are adequate alternatives: - Pipeline: Classpath Step Summary and description of the vulnerabilities are below. Some more details, severity, and attribution can be found here: https://jenkins.io/security/advisory/2017-03-20/ We provide advance notification for security updates on this mailing list: https://groups.google.com/d/forum/jenkinsci-advisories If you find security vulnerabilities in Jenkins, please report them as described here: https://jenkins.io/security/#reporting-vulnerabilities --- SECURITY-161 / CVE-2017-2648 SSH Slaves Plugin did not verify host keys of hosts it connected to. SECURITY-251 / CVE-2017-2649 Active Directory Plugin did not verify TLS certificate of AD server. SECURITY-336 / CVE-2017-2650 Pipeline: Classpath Step plugin allows Script Security sandbox bypass for users with SCM commit access, as well as users with e.g. Job/Configure permission in Jenkins. SECURITY-372 / CVE-2017-2651 (Mailer) SECURITY-372 / CVE-2017-2654 (Email Extension) Emails could be sent to addresses not associated with actual users of Jenkins by Mailer Plugin and Email Extension Plugin if they were configured to send notifications to a dynamically created list of users based on SCM changes. In rare cases this even resulted in emails sent to people who were not involved in whatever project was being built. SECURITY-386 / CVE-2017-2652 There were no permission checks performed in the Distributed Fork plugin beyond the basic check for Overall/Read permission, allowing anyone with that permission to run arbitrary shell commands on all connected nodes.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ