Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 17 Apr 2019 16:40:14 +0200
From: Daniel Beck <ml@...kweb.net>
To: oss-security@...ts.openwall.com
Subject: Multiple vulnerabilities in Jenkins plugins

Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software. The following
releases contain fixes for security vulnerabilities:

* Azure PublisherSettings Credentials Plugin 1.5
* GitLab Plugin 1.5.12
* jira-ext Plugin 0.9
* ontrack Jenkins Plugin 3.4.1

Additionally, these plugin have security vulnerabilities that have been made
public, but have no releases containing a fix yet:

* XebiaLabs XL Deploy Plugin

Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:
https://jenkins.io/security/advisory/2019-04-17/

We provide advance notification for security updates on this mailing list:
https://groups.google.com/d/forum/jenkinsci-advisories

If you discover security vulnerabilities in Jenkins, please report them as
described here:
https://jenkins.io/security/#reporting-vulnerabilities

---

SECURITY-1357 / CVE-2019-10300 (CSRF) and CVE-2019-10301 (permission check)
GitLab Plugin did not perform permission checks on a method implementing 
form validation. This allowed users with Overall/Read access to Jenkins to 
connect to an attacker-specified URL using attacker-specified credentials 
IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, this form validation method did not require POST requests, 
resulting in a cross-site request forgery vulnerability.


SECURITY-836 / CVE-2019-10302
jira-ext Plugin stored credentials unencrypted in its global configuration 
file hudson.plugins.jira.JiraProjectProperty.xml on the Jenkins master. 
These credentials could be viewed by users with access to the master file 
system.


SECURITY-844 / CVE-2019-10303
Azure PublisherSettings Credentials Plugin stored the service management 
certificate unencrypted in credentials.xml on the Jenkins master. These 
credentials could be viewed by users with access to the master file system.


SECURITY-983 / CVE-2019-10304 (CSRF) and CVE-2019-10305 (permission check)
A missing permission check in a form validation method in XebiaLabs XL 
Deploy Plugin allows users with Overall/Read permission to initiate a 
connection test to an attacker-specified server with attacker-specified 
credentials.

Additionally, the form validation method does not require POST requests, 
resulting in a CSRF vulnerability.


SECURITY-1341 / CVE-2019-10306
ontrack Jenkins Plugin supports sandboxed Groovy expressions. Its sandbox 
protection could be circumvented during parsing, compilation, and script 
instantiation by providing a crafted Groovy script.

This allowed users able to control the plugin’s job-specific configuration 
to bypass the sandbox protection and execute arbitrary code on the Jenkins 
master.

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.