Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 5 Dec 2017 11:09:33 +0100
From: Daniel Beck <>
Subject: Jenkins stored cross-site scripting vulnerability

Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software.

The Jenkins project released a security advisory today. A description of the
vulnerability is below. More details, severity, and attribution can be found

We provide advance notification for security updates on this mailing list:

If you discover security vulnerabilities in Jenkins, please report them as
described here:


Jenkins administrators can configure tools, such as JDK, Maven, or Ant,
that will be available in job configurations for use by build scripts. Some
tool names are not properly escaped on job configuration forms, resulting
in a stored cross-site scripting vulnerability.

Tools confirmed to be affected are:
- JDK (provided by Jenkins core)
- Ant (provided by Ant plugin)

Others may also be affected by this.

This vulnerability can only be exploited by Jenkins administrators, as
they’re the only ones able to define tools. In the vast majority of Jenkins
configurations, administrators are able to run any code and install any
plugin. Therefore this vulnerability only really affects installations that
don’t grant administrators the Run Scripts, Configure Update Sites, and
Install Plugins permissions.

The Jenkins project has prepared a plugin preventing the configuration of
unsafe tool names at as a
workaround. If you’re affected by this issue, we recommend installing this

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ