Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 7 Aug 2019 16:06:44 +0200
From: Daniel Beck <ml@...kweb.net>
To: oss-security@...ts.openwall.com
Subject: Multiple vulnerabilities in Jenkins plugins

Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software. The following
releases contain fixes for security vulnerabilities:

* Configuration as Code Plugin 1.27
* JClouds Plugin 2.15

Additionally, we announce unresolved security issues in the following
plugins: 

* Avatar Plugin
* Build Pipeline Plugin
* Codefresh Integration Plugin
* eggPlant Plugin
* File System SCM Plugin
* Gitlab Authentication Plugin
* Google Cloud Messsaging Notification Plugin
* Mask Passwords Plugin
* PegDown Formatter Plugin
* Relution Enterprise Appstore Publisher Plugin
* Simple Travis Pipeline Runner Plugin
* TestLink Plugin
* VMware Lab Manager Slaves Plugin
* Wall Display Master Project Plugin
* XL TestView Plugin

Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:
https://jenkins.io/security/advisory/2019-08-07/

We provide advance notification for security updates on this mailing list:
https://groups.google.com/d/forum/jenkinsci-advisories

If you discover security vulnerabilities in Jenkins, please report them as
described here:
https://jenkins.io/security/#reporting-vulnerabilities

---


SECURITY-1497 / CVE-2019-10367
Configuration as Code Plugin logs the changes it applies to the Jenkins 
system log. Secrets such as passwords should be masked (i.e. replaced with 
asterisks) in that log to prevent accidental disclosure. Configuration as 
Code Plugin inspects the type and looks for a field, getter, or constructor 
argument corresponding to the property, making the secret detection much 
more robust for the purpose of log message masking. This was implemented in 
the fix for SECURITY-1279 in the 2019-07-31 security advisory.

That fix was incomplete and did not cover a log message written to the 
logger io.jenkins.plugins.casc.impl.configurators.DataBoundConfigurator.


SECURITY-1482 / CVE-2019-10368 (CSRF), CVE-2019-10369 (permission check)
JClouds Plugin did not perform permission checks on a method implementing 
form validation. This allowed users with Overall/Read access to Jenkins to 
connect to an attacker-specified URL using attacker-specified credentials 
IDs obtained through another method, capturing credentials stored in
Jenkins.

Additionally, this form validation method did not require POST requests, 
resulting in a cross-site request forgery vulnerability.


SECURITY-157 / CVE-2019-10370
Mask Passwords Plugin allows specifying passwords to be provided to builds 
in the global Jenkins configuration.

While the passwords are stored encrypted on disk, they are transmitted in 
plain text as part of the configuration form. This can result in exposure 
of the password through browser extensions, cross-site scripting 
vulnerabilities, and similar situations.


SECURITY-795 / CVE-2019-10371
Gitlab Authentication Plugin does not invalidate the previous session and 
create a new one upon successful login. This allows attackers able to 
control or obtain another user’s pre-login session ID to impersonate them.


SECURITY-796 / CVE-2019-10372
Gitlab Authentication Plugin records the HTTP Referer header when the 
authentication process starts and redirects users to that URL when the user 
has finished logging in.

This implements an open redirect, allowing malicious sites to implement a 
phishing attack, with users expecting they have just logged in to Jenkins.


SECURITY-879 / CVE-2019-10373
Build Pipeline Plugin does not properly escape variables in views, 
resulting in a stored cross-site scripting vulnerability exploitable by 
users with permission to configure build pipelines.

This vulnerability is only exploitable on Jenkins releases older than 2.146 
or 2.138.2 due to the security hardening implemented in those releases.


SECURITY-142 / CVE-2019-10374
PegDown Formatter Plugin uses the PegDown library to implement support for 
rendering Markdown formatted descriptions in Jenkins. It advertises 
disabling of HTML to prevent cross-site scripting (XSS) as a feature.

PegDown Formatter Plugin does not prevent the use of javascript: scheme in 
URLs for links. This results in an XSS vulnerability exploitable by users 
able to configure entities with descriptions or similar properties that are 
rendered by the configured markup formatter.


SECURITY-569 / CVE-2019-10375
File System SCM Plugin allows users able to configure jobs to read 
arbitrary files from the Jenkins master, even if the job is running on an 
agent.


SECURITY-751 / CVE-2019-10376
Wall Display Master Project Plugin does not properly escape the customTheme 
query parameter, resulting in a reflected cross-site scripting vulnerability.


SECURITY-1099 / CVE-2019-10377
Avatar Plugin does not implement a permission check for the HTTP URL used 
to replace user avatars. This allows any user with Overall/Read permission 
to change any other user’s avatar, in addition to their own.


SECURITY-1428 / CVE-2019-10378
TestLink Plugin stores credentials unencrypted in its global configuration 
file hudson.plugins.testlink.TestLinkBuilder.xml on the Jenkins master. 
These credentials can be viewed by users with access to the master file 
system.


SECURITY-591 / CVE-2019-10379
Google Cloud Messsaging Notification Plugin stores an API key unencrypted 
in its global configuration file org.jenkinsci.plugins.gcm.im.GcmPublisher.
xml on the Jenkins master. These credentials can be viewed by users with 
access to the master file system.


SECURITY-922 / CVE-2019-10380
Simple Travis Pipeline Runner Plugin defines a custom whitelist for scripts 
protected by the Script Security sandbox.

This custom whitelist allows the use of methods that can be used to bypass 
Script Security sandbox protection. This results in arbitrary code 
execution on any Jenkins instance with this plugin installed.


SECURITY-931 / CVE-2019-10381
Codefresh Integration Plugin unconditionally disables SSL/TLS certificate 
validation for the entire Jenkins master JVM.


SECURITY-1376 / CVE-2019-10382
VMware Lab Manager Slaves Plugin unconditionally disables SSL/TLS 
certificate validation for the entire Jenkins master JVM.


SECURITY-1430 / CVE-2019-10385
eggPlant Plugin stores credentials unencrypted in job config.xml files on 
the Jenkins master. These credentials can be viewed by users with Extended 
Read permission, or access to the master file system.


SECURITY-1008 / CVE-2019-10386 (CSRF), CVE-2019-10387 (permission check)
XL TestView Plugin does not perform permission checks on a method 
implementing form validation. This allows users with Overall/Read access to 
Jenkins to connect to an attacker-specified URL using attacker-specified 
credentials IDs obtained through another method, capturing credentials 
stored in Jenkins.

Additionally, this form validation method does not require POST requests, 
resulting in a cross-site request forgery vulnerability.


SECURITY-1053 / CVE-2019-10388 (CSRF), CVE-2019-10389 (permission check)
A missing permission check in a form validation method in Relution 
Enterprise Appstore Publisher Plugin allows users with Overall/Read 
permission to initiate a connection test to an attacker-specified URL using 
attacker-specified credentials and attacker-specified HTTP proxy 
configuration.

Additionally, the form validation method does not require POST requests, 
resulting in a CSRF vulnerability.

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.