[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 7 Apr 2020 14:19:48 +0200
From: Daniel Beck <ml@...kweb.net>
To: oss-security@...ts.openwall.com
Subject: Multiple vulnerabilities in Jenkins plugins
Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software.
The following releases contain fixes for security vulnerabilities:
* AWSEB Deployment Plugin 0.3.20
* Code Coverage API Plugin 1.1.5
* FitNesse Plugin 1.33
* Gatling Plugin 1.3.0
* useMango Runner Plugin 1.5
Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:
https://jenkins.io/security/advisory/2020-04-07/
We provide advance notification for security updates on this mailing list:
https://groups.google.com/d/forum/jenkinsci-advisories
If you discover security vulnerabilities in Jenkins, please report them as
described here:
https://jenkins.io/security/#reporting-vulnerabilities
---
SECURITY-1699 / CVE-2020-2172
Code Coverage API Plugin 1.1.4 and earlier does not configure its XML
parser to prevent XML external entity (XXE) attacks. This allows a user
able to control the input files for the "Publish Coverage Report"
post-build step to have Jenkins parse a crafted file that uses external
entities for extraction of secrets from the Jenkins master or server-side
request forgery.
SECURITY-1633 / CVE-2020-2173
Gatling Plugin 1.2.7 and earlier serves Gatling reports in a manner that
bypasses the `Content-Security-Policy` protection introduced in Jenkins
1.641 and 1.625.3. This results in a cross-site scripting (XSS)
vulnerability exploitable by users able to change report content.
SECURITY-1769 / CVE-2020-2174
AWSEB Deployment Plugin 0.3.19 and earlier does not escape various values
printed as part of form validation output.
This results in a reflected cross-site scripting (XSS) vulnerability.
SECURITY-1801 / CVE-2020-2175
FitNesse Plugin 1.31 and earlier does not correctly escape report contents
before showing them on the Jenkins UI.
This results in a stored cross-site scripting (XSS) vulnerability
exploitable by users able to control the XML input files processed by the
plugin.
SECURITY-1780 / CVE-2020-2176
Multiple form validation endpoints in useMango Runner Plugin 1.4 and
earlier do not escape values received from the useMango service.
This results in a cross-site scripting (XSS) vulnerability exploitable by
users able to control the values returned from the useMango service.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
