Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 19 Feb 2019 19:33:19 +0100
From: Daniel Beck <ml@...kweb.net>
To: oss-security@...ts.openwall.com
Subject: Multiple vulnerabilities in Jenkins plugins

Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software. The following
releases contain fixes for security vulnerabilities:

* Acunetix Plugin 1.1.0
* Arxan MAM Publisher Plugin 2.0
* Cloud Foundry Plugin 2.3.2
* ElectricFlow Plugin 1.1.5
* JMS Messaging Plugin 1.1.2
* Mattermost Notification Plugin 2.6.3
* OctopusDeploy Plugin 1.9.0
* Script Security Plugin 1.53

Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:
https://jenkins.io/security/advisory/2019-02-19/

We provide advance notification for security updates on this mailing list:
https://groups.google.com/d/forum/jenkinsci-advisories

If you discover security vulnerabilities in Jenkins, please report them as
described here:
https://jenkins.io/security/#reporting-vulnerabilities

---

SECURITY-1320
The previously implemented Script Security Plugin sandbox protections
prohibiting the use of unsafe AST transforming annotations such as @Grab 
could be circumvented through use of various Groovy language features:

* Using Groovy’s AnnotationCollector
* Import aliasing
* Referencing annotation types using their full class name

This allowed users with Overall/Read permission, or the ability to control
Jenkinsfile or sandboxed Pipeline shared library contents in SCM, to 
bypass the sandbox protection and execute arbitrary code on the Jenkins 
master.

Using AnnotationCollector is now newly prohibited in sandboxed scripts 
such as Pipelines. Importing any of the annotations considered unsafe will
now result in an error. During the compilation phase, both simple and 
full class names of prohibited annotations are rejected for element 
annotations.


SECURITY-876
Cloud Foundry Plugin did not perform permission checks on a method 
implementing form validation. This allowed users with Overall/Read access 
to Jenkins to connect to an attacker-specified URL using attacker-
specified credentials IDs obtained through another method, capturing 
credentials stored in Jenkins.

Additionally, this form validation method did not require POST requests, 
resulting in a cross-site request forgery vulnerability.


SECURITY-985
A missing permission check in a form validation method in Mattermost 
Notification Plugin allowed users with Overall/Read permission to 
initiate a connection test, connecting to an attacker-specified 
Mattermost server and room and posting a message.

Additionally, this form validation method did not require POST requests, 
resulting in a CSRF vulnerability.


SECURITY-817
A missing permission check in a form validation method in OctopusDeploy 
Plugin allowed users with Overall/Read permission to initiate a 
connection test, sending an HTTP HEAD request to an attacker-specified 
URL, returning HTTP response code if successful, or exception error 
message otherwise.

Additionally, this form validation method did not require POST requests, 
resulting in a CSRF vulnerability.


SECURITY-1033
A missing permission check in a form validation method in JMS Messaging 
Plugin allowed users with Overall/Read permission to initiate a 
connection test, sending an HTTP request to an attacker-specified URL.

Additionally, this form validation method did not require POST requests, 
resulting in a CSRF vulnerability.


SECURITY-937
ElectricFlow Plugin unconditionally disabled SSL/TLS certificate 
validation for the entire Jenkins master JVM.


SECURITY-951
Acunetix Plugin stored the API Key in its configuration unencrypted in 
its global configuration file on the Jenkins master. This key could be 
viewed by users with access to the master file system.


SECURITY-980
A missing permission check in a form validation method in Acunetix Plugin 
allowed users with Overall/Read permission to initiate a connection test, 
sending an HTTP GET request to an attacker-specified URL, adding a /me 
suffix, returning whether the connection could be established and whether 
the HTTP response code is 200.

Additionally, this form validation method did not require POST requests, 
resulting in a CSRF vulnerability.


SECURITY-1070
Arxan MAM Publisher Plugin stored the username and password connection 
credentials in its configuration unencrypted in jobs' config.xml files on 
the Jenkins master. This key could be viewed by users with Extended Read 
permission, or access to the master file system.

While masked from view using a password form field, the password was 
transferred in plain text to users when accessing the job configuration 
form.

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.