Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 16 Oct 2019 14:59:44 +0200
From: Daniel Beck <ml@...kweb.net>
To: oss-security@...ts.openwall.com
Subject: Multiple vulnerabilities in Jenkins plugins

Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software. The following
releases contain fixes for security vulnerabilities:

* Bumblebee HP ALM Plugin 4.1.4
* Cadence vManager Plugin 2.7.1
* CRX Content Package Deployer Plugin 1.9
* Google Kubernetes Engine Plugin 0.7.1
* Google OAuth Credentials Plugin 0.10
* iceScrum Plugin 1.1.6
* NeoLoad Plugin 2.2.6

Additionally, we announce unresolved security issues in the following
plugins:

* Delphix Plugin
* ElasticBox CI Plugin
* Extensive Testing Plugin
* Fortify on Demand Plugin
* Puppet Enterprise Pipeline Plugin
* Oracle Cloud Infrastructure Compute Classic Plugin
* Rundeck Plugin
* SOASTA CloudTest Plugin
* Sofy.AI Plugin
* View26 Test-Reporting Plugin

Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:
https://jenkins.io/security/advisory/2019-10-16/

We provide advance notification for security updates on this mailing list:
https://groups.google.com/d/forum/jenkinsci-advisories

If you discover security vulnerabilities in Jenkins, please report them as
described here:
https://jenkins.io/security/#reporting-vulnerabilities

---


SECURITY-1583 / CVE-2019-10436
Google OAuth Credentials Plugin allowed the creation of credentials based 
on the content of files on the Jenkins master through a feature retaining 
backwards compatibility with earlier plugin releases.

This allowed users with the permission to configure jobs and credentials to 
read arbitrary files on the Jenkins master by creating a credential 
referencing an arbitrary file on the Jenkins master.


SECURITY-1006 (1) / CVE-2019-10437 (CSRF), CVE-2019-10438 (permission check)
CRX Content Package Deployer Plugin did not perform permission checks on a 
method implementing form validation. This allowed users with Overall/Read 
access to Jenkins to connect to an attacker-specified URL using attacker-
specified credentials IDs obtained through another method, capturing 
credentials stored in Jenkins.

Additionally, the form validation method did not require POST requests, 
resulting in a CSRF vulnerability.


SECURITY-1006 (2) / CVE-2019-10439
CRX Content Package Deployer Plugin provides a list of applicable 
credential IDs to allow users configuring the plugin to select the one to 
use.

This functionality did not correctly check permissions, allowing any user 
with Overall/Read permission to get a list of valid credentials IDs. Those 
could be used as part of an attack to capture the credentials using another 
vulnerability.


SECURITY-1427 / CVE-2019-10440
NeoLoad Plugin stored credentials unencrypted in its global configuration 
file org.jenkinsci.plugins.neoload.integration.NeoGlobalConfig.xml and in 
job config.xml files on the Jenkins master. These credentials could be 
viewed by users with Extended Read permission or access to the master file 
system.


SECURITY-1484 / CVE-2019-10441 (CSRF), CVE-2019-10442 (permission check)
iceScrum Plugin did not perform permission checks on a method implementing 
form validation. This allowed users with Overall/Read access to Jenkins to 
initiate a connection test to an attacker-specified server with attacker-
specified access token or username and password.

Additionally, the form validation method did not require POST requests, 
resulting in a CSRF vulnerability.


SECURITY-1436 / CVE-2019-10443
iceScrum Plugin stored credentials unencrypted in job config.xml files on 
the Jenkins master. These credentials could be viewed by users with 
Extended Read permission or access to the master file system.


SECURITY-1481 / CVE-2019-10444
Bumblebee HP ALM Plugin unconditionally disabled SSL/TLS certificate 
validation for connections to the HP ALM service.


SECURITY-1607 / CVE-2019-10445
Missing permission checks in Google Kubernetes Engine Plugin allowed users 
with Overall/Read permission to obtain limited information about the scope 
and access of a credential with an attacker-specified credential ID 
obtained through another method.


SECURITY-1615 / CVE-2019-10446
Cadence vManager Plugin unconditionally disabled SSL/TLS certificate 
validation for the entire Jenkins master JVM.


SECURITY-918 / CVE-2019-10458
Puppet Enterprise Pipeline Plugin defines a custom whitelist for all 
scripts protected by the Script Security sandbox.

This custom whitelist allows the use of methods that can be used to bypass 
Script Security sandbox protection. This results in arbitrary code 
execution on any Jenkins instance with this plugin installed.

As of publication of this advisory there is no fix.


SECURITY-1431 / CVE-2019-10447
Sofy.AI Plugin stores an API token unencrypted in job config.xml files on 
the Jenkins master. This token can be viewed by users with Extended Read 
permission or access to the master file system.

As of publication of this advisory there is no fix.


SECURITY-1432 / CVE-2019-10448
Extensive Testing Plugin stores credentials unencrypted in job config.xml 
files on the Jenkins master. These credentials can be viewed by users with 
Extended Read permission or access to the master file system.

As of publication of this advisory there is no fix.


SECURITY-1433 / CVE-2019-10449
Fortify on Demand Plugin stores credentials unencrypted in job config.xml 
files on the Jenkins master. These credentials can be viewed by users with 
Extended Read permission or access to the master file system.

As of publication of this advisory there is no fix.


SECURITY-1434 / CVE-2019-10450
ElasticBox CI Plugin stores an access token unencrypted in the global config
.xml configuration file on the Jenkins master. This token can be viewed by 
users with Extended Read permission or access to the master file system.

As of publication of this advisory there is no fix.


SECURITY-1439 / CVE-2019-10451
SOASTA CloudTest Plugin stores credentials unencrypted in its global 
configuration file com.soasta.jenkins.CloudTestServer.xml on the Jenkins 
master. These credentials could be viewed by users with access to the 
master file system.

As of publication of this advisory there is no fix.


SECURITY-1440 / CVE-2019-10452
View26 Test-Reporting Plugin stores an access token unencrypted in job 
config.xml files on the Jenkins master. This token can be viewed by users 
with Extended Read permission or access to the master file system.

As of publication of this advisory there is no fix.


SECURITY-1450 / CVE-2019-10453
Delphix Plugin stores credentials unencrypted in its global configuration 
file io.jenkins.plugins.delphix.GlobalConfiguration.xml on the Jenkins 
master. These credentials could be viewed by users with access to the 
master file system.

As of publication of this advisory there is no fix.


SECURITY-1460 / CVE-2019-10454 (CSRF), CVE-2019-10455 (permission check)
Rundeck Plugin does not perform permission checks on a method implementing 
form validation. This allows users with Overall/Read access to Jenkins to 
initiate a connection test to an attacker-specified server with attacker-
specified username and password.

Additionally, the form validation method does not require POST requests, 
resulting in a CSRF vulnerability.

As of publication of this advisory there is no fix.


SECURITY-1462 / CVE-2019-10456 (CSRF), CVE-2019-10457 (permission check)
Oracle Cloud Infrastructure Compute Classic Plugin does not perform 
permission checks on a method implementing form validation. This allows 
users with Overall/Read access to Jenkins to initiate a connection test to 
an attacker-specified server with attacker-specified username and password.

Additionally, the form validation method does not require POST requests, 
resulting in a CSRF vulnerability.

As of publication of this advisory there is no fix.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.