Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 21 Mar 2017 02:19:41 +0100
From: Daniel Beck <>
Subject: Jenkins plugins -- multiple vulnerabilities

Jenkins is an open source automation server which enables developers around 
the world to reliably build, test, and deploy their software. The following 
plugin releases published today contain fixes for security vulnerabilities:

- Active Directory 2.3
- DistFork Plugin 1.6.0
- Email Extension (email-ext) 2.57.1
- Mailer Plugin 1.20
- SSH Slaves 1.15

Users of these plugins should upgrade them to the indicated versions.

Additionally, one plugin was removed from distribution as there are no plans 
to fix its vulnerability, and there are adequate alternatives:

- Pipeline: Classpath Step

Summary and description of the vulnerabilities are below. Some more details, 
severity, and attribution can be found here:

We provide advance notification for security updates on this mailing list:

If you find security vulnerabilities in Jenkins, please report them as 
described here:


SECURITY-161 / CVE-2017-2648
SSH Slaves Plugin did not verify host keys of hosts it connected to.

SECURITY-251 / CVE-2017-2649
Active Directory Plugin did not verify TLS certificate of AD server.

SECURITY-336 / CVE-2017-2650
Pipeline: Classpath Step plugin allows Script Security sandbox bypass for 
users with SCM commit access, as well as users with e.g. Job/Configure 
permission in Jenkins.

SECURITY-372 / CVE-2017-2651 (Mailer)
SECURITY-372 / CVE-2017-2654 (Email Extension)
Emails could be sent to addresses not associated with actual users of Jenkins 
by Mailer Plugin and Email Extension Plugin if they were configured to send 
notifications to a dynamically created list of users based on SCM changes. In 
rare cases this even resulted in emails sent to people who were not involved 
in whatever project was being built.

SECURITY-386 / CVE-2017-2652
There were no permission checks performed in the Distributed Fork plugin 
beyond the basic check for Overall/Read permission, allowing anyone with that 
permission to run arbitrary shell commands on all connected nodes.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.