oss-sec mailing list archives
Multiple vulnerabilities in Jenkins plugins
From: Daniel Beck <ml () beckweb net>
Date: Mon, 16 Apr 2018 13:25:08 +0200
Jenkins is an open source automation server which enables developers around the world to reliably build, test, and deploy their software. The following releases contain fixes for security vulnerabilities: * Email Extension 2.62 * Google Login 1.3.1 * HTML Publisher 1.16 * S3 Publisher 0.11.0 Summaries of the vulnerabilities are below. More details, severity, and attribution can be found here: https://jenkins.io/security/advisory/2018-04-16/ We provide advance notification for security updates on this mailing list: https://groups.google.com/d/forum/jenkinsci-advisories If you find security vulnerabilities in Jenkins, please report them as described here: https://jenkins.io/security/#reporting-vulnerabilities --- SECURITY-442 Google Login Plugin did not invalidate the previous session and create a new one upon successful login, allowing attackers able to control or obtain another user’s pre-login session ID to impersonate them. SECURITY-684 Google Login Plugin redirected users to an arbitrary URL specified as a query parameter after successful login, enabling phishing attacks. SECURITY-729 Email Extension Plugin stores an SMTP password in the global Jenkins configuration. While the password is stored encrypted on disk, it was transmitted in plain text as part of the configuration form. This could result in exposure of the password through browser extensions, cross-site scripting vulnerabilities, and similar situations. SECURITY-730 S3 Publisher Plugin did not properly escape file names shown on the Jenkins UI. This resulted in a cross-site scripting vulnerability exploitable by users able to control the names of uploaded files. SECURITY-784 HTML Publisher Plugin allows specifying a name for the HTML reports it publishes. This report name was used in the URL of the report and as a directory name on the Jenkins master without further processing, resulting in a path traversal vulnerability that allowed overriding files outside the intended directory.
Current thread:
- Re: Multiple vulnerabilities in Jenkins plugins Daniel Beck (Apr 05)
- <Possible follow-ups>
- Multiple vulnerabilities in Jenkins plugins Daniel Beck (Apr 16)
- Multiple vulnerabilities in Jenkins plugins Daniel Beck (Jun 04)
- Re: Multiple vulnerabilities in Jenkins plugins Daniel Beck (Jun 05)
- Multiple vulnerabilities in Jenkins plugins Daniel Beck (Jun 25)
- Re: Multiple vulnerabilities in Jenkins plugins Daniel Beck (Jun 25)