Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 18 Jul 2018 16:38:38 +0200
From: Daniel Beck <>
Subject: Multiple vulnerabilities in Jenkins

Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software. The following
releases contain fixes for security vulnerabilities:

* Jenkins (weekly) 2.133
* Jenkins (LTS) 2.121.2

Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:

We provide advance notification for security updates on this mailing list:

If you discover security vulnerabilities in Jenkins, please report them as
described here:


Unauthenticated users could provide maliciously crafted login credentials 
that cause Jenkins to move the config.xml file from the Jenkins home 
directory. This configuration file contains basic configuration of 
Jenkins, including the selected security realm and authorization strategy. 
If Jenkins is started without this file present, it will revert to the 
legacy defaults of granting administrator access to anonymous users.

An arbitrary file read vulnerability in the Stapler web framework used by 
Jenkins allowed unauthenticated users to send crafted HTTP requests 
returning the contents of any file on the Jenkins master file system that 
the Jenkins master process has access to.

The URLs handling cancellation of queued builds did not perform a 
permission check, allowing users with Overall/Read permission to cancel 
queued builds.

The URL that initiates agent launches on the Jenkins master did not perform 
a permission check, allowing users with Overall/Read permission to initiate 
agent launches.

The build timeline widget shown on URLs like /view/…/builds did not 
properly escape display names of items. This resulted in a cross-site 
scripting vulnerability exploitable by users able to control item display 

Files indicating when a plugin JPI file was last extracted into a 
subdirectory of plugins/ in the Jenkins home directory was accessible via 
HTTP by users with Overall/Read permission. This allowed unauthorized users 
to determine the likely install date of a given plugin.

Stapler is the web framework used by Jenkins to route HTTP requests. When 
its debug mode is enabled, HTTP 404 error pages display diagnostic 
information. Those error pages did not escape parts of URLs they displayed, 
in rare cases resulting in a cross-site scripting vulnerability.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.