Multiple vulnerabilities in Jenkins plugins

[Daniel Beck <ml () beckweb net>]

Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software.

The following releases contain fixes for security vulnerabilities:

* AWSEB Deployment Plugin 0.3.20
* Code Coverage API Plugin 1.1.5
* FitNesse Plugin 1.33
* Gatling Plugin 1.3.0
* useMango Runner Plugin 1.5


Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:
https://jenkins.io/security/advisory/2020-04-07/

We provide advance notification for security updates on this mailing list:
https://groups.google.com/d/forum/jenkinsci-advisories

If you discover security vulnerabilities in Jenkins, please report them as
described here:
https://jenkins.io/security/#reporting-vulnerabilities

---

SECURITY-1699 / CVE-2020-2172
Code Coverage API Plugin 1.1.4 and earlier does not configure its XML
parser to prevent XML external entity (XXE) attacks. This allows a user
able to control the input files for the "Publish Coverage Report"
post-build step to have Jenkins parse a crafted file that uses external
entities for extraction of secrets from the Jenkins master or server-side
request forgery.


SECURITY-1633 / CVE-2020-2173
Gatling Plugin 1.2.7 and earlier serves Gatling reports in a manner that
bypasses the `Content-Security-Policy` protection introduced in Jenkins
1.641 and 1.625.3. This results in a cross-site scripting (XSS)
vulnerability exploitable by users able to change report content.


SECURITY-1769 / CVE-2020-2174
AWSEB Deployment Plugin 0.3.19 and earlier does not escape various values
printed as part of form validation output.

This results in a reflected cross-site scripting (XSS) vulnerability.


SECURITY-1801 / CVE-2020-2175
FitNesse Plugin 1.31 and earlier does not correctly escape report contents
before showing them on the Jenkins UI.

This results in a stored cross-site scripting (XSS) vulnerability
exploitable by users able to control the XML input files processed by the
plugin.


SECURITY-1780 / CVE-2020-2176
Multiple form validation endpoints in useMango Runner Plugin 1.4 and
earlier do not escape values received from the useMango service.

This results in a cross-site scripting (XSS) vulnerability exploitable by
users able to control the values returned from the useMango service.