Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 25 Jun 2018 16:10:22 +0200
From: Daniel Beck <ml@...kweb.net>
To: oss-security@...ts.openwall.com
Subject: Multiple vulnerabilities in Jenkins plugins

Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software. The following
releases contain fixes for security vulnerabilities:

* AWS CodeBuild 0.27
* AWS CodeDeploy 1.20
* AWS CodePipeline 0.37
* Badge 1.5
* CollabNet 2.0.5
* Configuration as Code 0.8-alpha
* Fortify CloudScan 1.5.2
* GitHub 1.29.2
* IBM z/OS Connector 2.0.0
* Openstack Cloud 2.36
* SAML 1.0.7
* SSH Credentials 1.14
* URLTrigger 0.43

Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:
https://jenkins.io/security/advisory/2018-06-25/

We provide advance notification for security updates on this mailing list:
https://groups.google.com/d/forum/jenkinsci-advisories

If you discover security vulnerabilities in Jenkins, please report them as
described here:
https://jenkins.io/security/#reporting-vulnerabilities

---

SECURITY-915
A form action method in GitHub Plugin did not check the permission of the 
user accessing it, allowing anyone with Overall/Read access to Jenkins to 
cause Jenkins to send a GitHub API request to create an API token to a an 
attacker specified URL.

This allowed users with Overall/Read access to Jenkins to connect to an 
attacker-specified URL using attacker-specified credentials IDs obtained 
through another method, capturing credentials stored in Jenkins.

Additionally, this form validation method did not require POST requests, 
resulting in a CSRF vulnerability.


SECURITY-440
SSH Credentials Plugin allowed the creation of SSH credentials with keys 
"From a file on Jenkins master". Credentials Binding Plugin 1.13 and newer 
allows binding SSH credentials to environment variables. In combination, 
these two features allow users with the permission to configure a job to 
read arbitrary files on the Jenkins master by creating an SSH credential 
referencing an arbitrary file on the Jenkins master, and binding it to an 
environment variable in a job.


SECURITY-916
SAML Plugin did not invalidate the previous session and create a new one 
upon successful login, allowing attackers able to control or obtain 
another user’s pre-login session ID to impersonate them.


SECURITY-808
Openstack Cloud Plugin did not perform permission checks on methods 
implementing form validation. This allowed users with Overall/Read access 
to Jenkins to connect to an attacker-specified URL using attacker-
specified credentials IDs obtained through another method, capturing 
credentials stored in Jenkins, and to cause Jenkins to submit HTTP 
requests to attacker-specified URLs.

Additionally, these form validation methods did not require POST requests, 
resulting in a CSRF vulnerability.


SECURITY-825 / CVE-2018-1000402
AWS CodeDeploy Plugin could persist environment variables from the last 
run of any project with the post-build step configured in the job’s
config.xml file.

In some cases, this allowed users with file system access or Extended Read 
permission to obtain those potentially sensitive environment variables by 
accessing the project’s config.xml.


SECURITY-833 / CVE-2018-1000403
AWS CodeDeploy Plugin stored the AWS Secret Key in its configuration 
unencrypted in jobs' config.xml files on the Jenkins master. This key 
could be viewed by users with Extended Read permission, or access to the 
master file system.

While masked from view using a password form field, the AWS Secret Key was 
transferred in plain text to users when accessing the job configuration 
form.


SECURITY-834 / CVE-2018-1000404
AWS CodeBuild Plugin stored the AWS Secret Key in its configuration 
unencrypted in jobs' config.xml files on the Jenkins master. This key 
could be viewed by users with Extended Read permission, or access to the 
master file system.

While masked from view using a password form field, the AWS Secret Key was 
transferred in plain text to users when accessing the job configuration 
form.


SECURITY-967 / CVE-2018-1000401
AWS CodePipeline Plugin stored the AWS Secret Key in its configuration 
unencrypted in jobs' config.xml files on the Jenkins master. This key 
could be viewed by users with Extended Read permission, or access to the 
master file system.

While masked from view using a password form field, the AWS Secret Key was 
transferred in plain text to users when accessing the job configuration 
form.


SECURITY-906
Badge Plugin stored and displayed user-provided HTML for badges and 
summaries unprocessed, allowing users with the ability to control badge 
content to store malicious HTML to be displayed within Jenkins.


SECURITY-941
CollabNet Plugin disabled SSL/TLS certificate validation for the entire 
Jenkins master JVM by default.


SECURITY-819
A form validation method in URLTrigger Plugin did not check the permission 
of the user accessing them, allowing anyone with Overall/Read access to 
Jenkins to cause Jenkins to send a GET request to a specified URL.

Additionally, this form validation method did not require POST requests, 
resulting in a CSRF vulnerability.


SECURITY-870
Fortify CloudScan Plugin did not validate file names in rulepack ZIP 
archives it extracts, resulting in an arbitrary file write vulnerability.


SECURITY-950
IBM z/OS Connector Plugin did not encrypt password credentials stored in 
its configuration. This could be used by users with master file system 
access to obtain the password.

While masked from view using a password form field, the AWS Secret Key was 
transferred in plain text to administrators when accessing the global 
configuration form.


SECURITY-927
Configuration as Code Plugin lacked a permission check in the method 
handling the URL exporting the system configuration. This allows users 
with Overall/Read access to Jenkins to obtain this YAML export.


SECURITY-929
Configuration as Code Plugin logged secrets set via its configuration to 
the Jenkins master system log in plain text. This allowed users with 
access to the Jenkins log files to obtain these passwords and similar 
secrets.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.