Jenkins Security Advisory 2020-01-15

{
  "id": "7f036c359e0f59e187ea3a4f76f00cd4494a20d9bca527bc5f04681cd975f4d9",
  "url": "https://www.jenkins.io/security/advisory/2020-01-15/",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Jenkins Security Advisory 2020-01-15",
    "summary": "The advisory describes vulnerabilities in six Jenkins plugins. Fixes are available for Amazon EC2, Health Advisor by CloudBees, Redgate SQL Change Automation, and Robot Framework plugins; no fixes were available for gitlab-hook or Sounds at publication.",
    "evidence": "This advisory announces vulnerabilities in the following Jenkins deliverables: Amazon EC2 Plugin gitlab-hook Plugin Health Advisor by CloudBees Plugin Redgate SQL Change Automation Plugin Robot Framework Plugin Sounds Plugin",
    "products": [
      {
        "name": {
          "value": "Amazon EC2 Plugin",
          "evidence": "Amazon EC2 Plugin 1.47 and earlier"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.48",
            "evidence": "Amazon EC2 Plugin 1.48 requires POST requests and Overall/Administer permission for the affected form validation methods."
          }
        ],
        "affected_versions": [
          {
            "value": "1.47 and earlier",
            "evidence": "Amazon EC2 Plugin 1.47 and earlier"
          }
        ]
      },
      {
        "name": {
          "value": "gitlab-hook Plugin",
          "evidence": "gitlab-hook Plugin 1.4.2 and earlier"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "1.4.2 and earlier",
            "evidence": "gitlab-hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint."
          }
        ]
      },
      {
        "name": {
          "value": "Health Advisor by CloudBees Plugin",
          "evidence": "Health Advisor by CloudBees Plugin 3.0 and earlier"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "3.0.1",
            "evidence": "Health Advisor by CloudBees Plugin 3.0.1 requires POST requests and Overall/Administer permission for the affected form validation methods."
          }
        ],
        "affected_versions": [
          {
            "value": "3.0 and earlier",
            "evidence": "Health Advisor by CloudBees Plugin 3.0 and earlier does not perform permission checks in methods performing form validation."
          }
        ]
      },
      {
        "name": {
          "value": "Redgate SQL Change Automation Plugin",
          "evidence": "Redgate SQL Change Automation Plugin 2.0.4 and earlier"
        },
        "prerequisites": [
          {
            "value": "Existing jobs need to have their configuration saved",
            "evidence": "Existing jobs need to have their configuration saved for existing plain text passwords to be overwritten."
          }
        ],
        "fixed_versions": [
          {
            "value": "2.0.5",
            "evidence": "Redgate SQL Change Automation Plugin 2.0.5 now stores the API key encrypted."
          }
        ],
        "affected_versions": [
          {
            "value": "2.0.4 and earlier",
            "evidence": "Redgate SQL Change Automation Plugin 2.0.4 and earlier stores a NuGet API key unencrypted in job config.xml files as part of its configuration."
          }
        ]
      },
      {
        "name": {
          "value": "Robot Framework Plugin",
          "evidence": "Robot Framework Plugin 2.0.0 and earlier"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.0.1",
            "evidence": "Robot Framework Plugin 2.0.1 disables external entity resolution for its XML parser."
          }
        ],
        "affected_versions": [
          {
            "value": "2.0.0 and earlier",
            "evidence": "Robot Framework Plugin 2.0.0 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks."
          }
        ]
      },
      {
        "name": {
          "value": "Sounds Plugin",
          "evidence": "Sounds Plugin 0.5 and earlier"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "0.5 and earlier",
            "evidence": "Sounds Plugin 0.5 and earlier does not perform permission checks in URLs performing form validation."
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2020-2090",
        "evidence": "SECURITY-1004 / CVE-2020-2090 (CSRF), CVE-2020-2091 (missing permission check)"
      },
      {
        "value": "CVE-2020-2091",
        "evidence": "SECURITY-1004 / CVE-2020-2090 (CSRF), CVE-2020-2091 (missing permission check)"
      },
      {
        "value": "CVE-2020-2092",
        "evidence": "SECURITY-1698 / CVE-2020-2092"
      },
      {
        "value": "CVE-2020-2093",
        "evidence": "SECURITY-1708 / CVE-2020-2093 (CSRF), CVE-2020-2094 (missing permission check)"
      },
      {
        "value": "CVE-2020-2094",
        "evidence": "SECURITY-1708 / CVE-2020-2093 (CSRF), CVE-2020-2094 (missing permission check)"
      },
      {
        "value": "CVE-2020-2095",
        "evidence": "SECURITY-1696 / CVE-2020-2095"
      },
      {
        "value": "CVE-2020-2096",
        "evidence": "SECURITY-1683 / CVE-2020-2096"
      },
      {
        "value": "CVE-2020-2097",
        "evidence": "SECURITY-814 / CVE-2020-2097 (permission check), CVE-2020-2098 (CSRF)"
      },
      {
        "value": "CVE-2020-2098",
        "evidence": "SECURITY-814 / CVE-2020-2097 (permission check), CVE-2020-2098 (CSRF)"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-jenkins-security-advisories",
  "document_id": 23996,
  "published_at": "2020-01-15T12:00:00+00:00"
}