[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 3 Dec 2020 16:22:46 +0100
From: Daniel Beck <ml@...kweb.net>
To: oss-security@...ts.openwall.com
Subject: Multiple vulnerabilities in Jenkins
Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software.
The following releases contain fixes for security vulnerabilities:
* Chaos Monkey Plugin 0.4 and 0.4.1
* CVS Plugin 2.17
* Plugin Installation Manager Tool 2.2.0
* Shelve Project Plugin 3.1
Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:
https://www.jenkins.io/security/advisory/2020-12-03/?
We provide advance notification for security updates on this mailing list:
https://groups.google.com/d/forum/jenkinsci-advisories
If you discover security vulnerabilities in Jenkins, please report them as
described here:
https://www.jenkins.io/security/#reporting-vulnerabilities
---
SECURITY-2146 / CVE-2020-2324
CVS Plugin 2.16 and earlier does not configure its XML parser to prevent
XML external entity (XXE) attacks.
This allows attackers able to control an agent process to have Jenkins
parse a crafted changelog file that uses external entities for extraction
of secrets from the Jenkins controller or server-side request forgery.
SECURITY-1856 / CVE-2020-2320
Plugin Installation Manager Tool is part of the Jenkins project Docker
images. As `jenkins-plugin-cli` it is used to download and install plugins
even before Jenkins is running.
Plugin Installation Manager Tool 2.1.3 and earlier does not verify plugin
downloads. This may allow third parties such as mirror operators to provide
crafted plugin downloads.
SECURITY-2108 / CVE-2020-2321
Shelve Project Plugin 3.0 and earlier does not require POST requests for
HTTP endpoints, resulting in cross-site request forgery (CSRF)
vulnerabilities.
These vulnerabilities allow attackers to shelve, unshelve, or delete a
project.
SECURITY-2109 (1) / CVE-2020-2322
Chaos Monkey Plugin 0.3 and earlier does not perform permission checks in
several HTTP endpoints.
This allows attackers with Overall/Read permission to generate load and to
generate memory leaks.
SECURITY-2109 (2) / CVE-2020-2323
Chaos Monkey Plugin 0.4 and earlier does not perform permission checks in
an HTTP endpoint.
This allows attackers with Overall/Read permission to access the Chaos
Monkey page and to see the history of actions.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
