Multiple vulnerabilities in Jenkins and Jenkins plugins

                							

                <!--X-Body-Begin-->
<!--X-User-Header-->

oss-sec
mailing list archives
<!--X-User-Header-End-->
<!--X-TopPNI-->

By Date

By Thread

</form>

<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
Multiple vulnerabilities in Jenkins and Jenkins plugins

<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->

From: Daniel Beck &lt;ml () beckweb net&gt;

Date: Wed, 28 Aug 2019 17:24:34 +0200

<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->

<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->
Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software. The following
releases contain fixes for security vulnerabilities:

* Jenkins weekly 2.192
* Jenkins LTS 2.176.3
* IBM Application Security on Cloud 1.2.5
* Splunk Plugin 1.8.0

Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:
https://jenkins.io/security/advisory/2019-08-28/

We provide advance notification for security updates on this mailing list:
https://groups.google.com/d/forum/jenkinsci-advisories

If you discover security vulnerabilities in Jenkins, please report them as
described here:
https://jenkins.io/security/#reporting-vulnerabilities

---

SECURITY-1453 / CVE-2019-10383
Jenkins did not properly escape the update site URL in some status 
messages shown in the update center, resulting in a stored cross-site 
scripting vulnerability that is exploitable by administrators and affects 
other administrators.

SECURITY-1491 / CVE-2019-10384
Jenkins allowed the creation of CSRF tokens without a corresponding web 
session ID. This is the result of an incomplete fix for SECURITY-626 in 
the 2019-07-17 security advisory. This allowed attackers able to obtain a 
CSRF token without associated session ID to implement CSRF attacks with 
the following constraints:

* The token had to be created for the anonymous user (and could only be 
  used for actions the anonymous user can perform)
* The victim’s IP address needed to remain unchanged (unless the proxy 
  compatibility option was enabled)
* The victim must not have a valid web session at the time of the attack

SECURITY-1294 / CVE-2019-10390
Splunk Plugin has a form validation HTTP endpoint used to validate a user-
submitted Groovy script through compilation, which was not subject to 
sandbox protection. This allowed attackers with Overall/Read access to 
execute arbitrary code on the Jenkins master by applying AST transforming 
annotations such as @Grab to source code elements.

SECURITY-1512 / CVE-2019-10391
IBM Application Security on Cloud Plugin stores service passwords in job
configurations.

While the password is stored encrypted on disk, it was transmitted in 
plain text as part of the configuration form. This could result in 
exposure of the password through browser extensions, cross-site scripting 
vulnerabilities, and similar situations.

<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->

<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->

By Date

By Thread

Current thread:

Multiple vulnerabilities in Jenkins and Jenkins plugins Daniel Beck (Aug 28)

&lt;Possible follow-ups&gt;
Multiple vulnerabilities in Jenkins and Jenkins plugins Daniel Beck (Sep 25)

 

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->