Date: Wed, 24 Feb 2021 15:52:03 +0100 From: Daniel Beck <ml@...kweb.net> To: oss-security@...ts.openwall.com Subject: Multiple vulnerabilities in Jenkins plugins Jenkins is an open source automation server which enables developers around the world to reliably build, test, and deploy their software. The following releases contain fixes for security vulnerabilities: * Active Choices Plugin 2.5.3 * Artifact Repository Parameter Plugin 1.0.1 * Claim Plugin 2.18.2 * Configuration Slicing Plugin 1.52 * Repository Connector Plugin 2.0.3 * Support Core Plugin 2.72.1 Summaries of the vulnerabilities are below. More details, severity, and attribution can be found here: https://www.jenkins.io/security/advisory/2021-02-24/ We provide advance notification for security updates on this mailing list: https://groups.google.com/d/forum/jenkinsci-advisories If you discover security vulnerabilities in Jenkins, please report them as described here: https://www.jenkins.io/security/#reporting-vulnerabilities --- SECURITY-2192 / CVE-2021-21616 Active Choices Plugin 2.5.2 and earlier does not escape reference parameter values. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. SECURITY-2003 / CVE-2021-21617 Configuration Slicing Plugin 1.51 and earlier does not require POST requests for the form submission endpoint reconfiguring slices, resulting in a cross-site request forgery (CSRF) vulnerability. This vulnerability allows attackers to apply different slice configurations to attacker-specified jobs. SECURITY-2183 / CVE-2021-21618 Repository Connector Plugin 2.0.2 and earlier does not escape parameter names and descriptions for past builds. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. SECURITY-2188 (1) / CVE-2021-21619 Claim Plugin 2.18.1 and earlier does not escape the user display name shown in claims. This results in a cross-site scripting (XSS) vulnerability exploitable by attackers who are able to control the display names of Jenkins users, either via the security realm, or directly inside Jenkins. NOTE: Everyone with a Jenkins account can change their own display name. SECURITY-2188 (2) / CVE-2021-21620 Claim Plugin 2.18.1 and earlier does not require POST requests for the form submission endpoint assigning claims, resulting in a cross-site request forgery (CSRF) vulnerability. This vulnerability allows attackers to change claims. SECURITY-2150 / CVE-2021-21621 Support Core Plugin 2.72 and earlier provides the serialized user authentication as part of the "About user (basic authentication details only)" information (`user.md`). In some configurations, this can include the session ID of the user creating the support bundle. Attackers with access to support bundle content and the Jenkins instance could use this information to impersonate the user who created the support bundle. SECURITY-2168 / CVE-2021-21622 Artifact Repository Parameter Plugin 1.0.0 and earlier does not escape parameter names and descriptions. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.