Jenkins Security Advisory 2023-07-12

{
  "id": "d0e5d05e5c86a8c80e82e7d1ed98a087dbfddadd5691f9a40a8dfcbc7f799e49",
  "url": "https://www.jenkins.io/security/advisory/2023-07-12/",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Jenkins Security Advisory 2023-07-12",
    "summary": "The advisory reports security vulnerabilities in multiple Jenkins plugins. It lists updated versions that fix some issues and states that no fixes are available for others.",
    "evidence": "These versions include fixes to the vulnerabilities described above.",
    "products": [
      {
        "name": {
          "value": "Active Directory Plugin",
          "evidence": "Active Directory Plugin should be updated to version 2.30.1"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.30.1",
            "evidence": "Active Directory Plugin should be updated to version 2.30.1"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 2.30",
            "evidence": "Active Directory Plugin up to and including 2.30"
          }
        ]
      },
      {
        "name": {
          "value": "Datadog Plugin",
          "evidence": "Datadog Plugin should be updated to version 5.4.2"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "5.4.2",
            "evidence": "Datadog Plugin should be updated to version 5.4.2"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 5.4.1",
            "evidence": "Datadog Plugin up to and including 5.4.1"
          }
        ]
      },
      {
        "name": {
          "value": "External Monitor Job Type Plugin",
          "evidence": "External Monitor Job Type Plugin should be updated to version 207.v98a_a_37a_85525"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "207.v98a_a_37a_85525",
            "evidence": "External Monitor Job Type Plugin should be updated to version 207.v98a_a_37a_85525"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 206.v9a_94ff0b_4a_10",
            "evidence": "External Monitor Job Type Plugin up to and including 206.v9a_94ff0b_4a_10"
          }
        ]
      },
      {
        "name": {
          "value": "mabl Plugin",
          "evidence": "mabl Plugin should be updated to version 0.0.47"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.0.47",
            "evidence": "mabl Plugin should be updated to version 0.0.47"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 0.0.46",
            "evidence": "mabl Plugin up to and including 0.0.46"
          }
        ]
      },
      {
        "name": {
          "value": "OpenShift Login Plugin",
          "evidence": "OpenShift Login Plugin should be updated to version 1.1.0.230.v5d7030b_f5432"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.1.0.230.v5d7030b_f5432",
            "evidence": "OpenShift Login Plugin should be updated to version 1.1.0.230.v5d7030b_f5432"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.1.0.227.v27e08dfb_1a_20",
            "evidence": "OpenShift Login Plugin up to and including 1.1.0.227.v27e08dfb_1a_20"
          }
        ]
      },
      {
        "name": {
          "value": "Oracle Cloud Infrastructure Compute Plugin",
          "evidence": "Oracle Cloud Infrastructure Compute Plugin should be updated to version 1.0.17"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.0.17",
            "evidence": "Oracle Cloud Infrastructure Compute Plugin should be updated to version 1.0.17"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.0.16",
            "evidence": "Oracle Cloud Infrastructure Compute Plugin up to and including 1.0.16"
          }
        ]
      },
      {
        "name": {
          "value": "Orka by MacStadium Plugin",
          "evidence": "Orka by MacStadium Plugin should be updated to version 1.34"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.34",
            "evidence": "Orka by MacStadium Plugin should be updated to version 1.34"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.33",
            "evidence": "Orka by MacStadium Plugin up to and including 1.33"
          }
        ]
      },
      {
        "name": {
          "value": "SAML Single Sign On(SSO) Plugin",
          "evidence": "SAML Single Sign On(SSO) Plugin should be updated to version 2.3.1"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.3.1",
            "evidence": "SAML Single Sign On(SSO) Plugin should be updated to version 2.3.1"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 2.3.0",
            "evidence": "SAML Single Sign On(SSO) Plugin up to and including 2.3.0"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2023-37942",
        "evidence": "SECURITY-3133 / CVE-2023-37942"
      },
      {
        "value": "CVE-2023-37943",
        "evidence": "SECURITY-3059 / CVE-2023-37943"
      },
      {
        "value": "CVE-2023-37944",
        "evidence": "SECURITY-3130 / CVE-2023-37944"
      },
      {
        "value": "CVE-2023-37945",
        "evidence": "SECURITY-3164 / CVE-2023-37945"
      },
      {
        "value": "CVE-2023-37946",
        "evidence": "SECURITY-2998 / CVE-2023-37946"
      },
      {
        "value": "CVE-2023-37947",
        "evidence": "SECURITY-2999 / CVE-2023-37947"
      },
      {
        "value": "CVE-2023-37948",
        "evidence": "SECURITY-3044 / CVE-2023-37948"
      },
      {
        "value": "CVE-2023-37949",
        "evidence": "SECURITY-3128 / CVE-2023-37949"
      },
      {
        "value": "CVE-2023-37950",
        "evidence": "SECURITY-3137 (1) / CVE-2023-37950"
      },
      {
        "value": "CVE-2023-37951",
        "evidence": "SECURITY-3137 (2) / CVE-2023-37951"
      },
      {
        "value": "CVE-2023-37952",
        "evidence": "CVE-2023-37952 (CSRF)"
      },
      {
        "value": "CVE-2023-37953",
        "evidence": "CVE-2023-37953 (missing permission check)"
      },
      {
        "value": "CVE-2023-37954",
        "evidence": "SECURITY-3033 / CVE-2023-37954"
      },
      {
        "value": "CVE-2023-37955",
        "evidence": "CVE-2023-37955 (CSRF)"
      },
      {
        "value": "CVE-2023-37956",
        "evidence": "CVE-2023-37956 (missing permission check)"
      },
      {
        "value": "CVE-2023-37957",
        "evidence": "SECURITY-3126 / CVE-2023-37957"
      },
      {
        "value": "CVE-2023-37958",
        "evidence": "CVE-2023-37958 (CSRF)"
      },
      {
        "value": "CVE-2023-37959",
        "evidence": "CVE-2023-37959 (missing permission check)"
      },
      {
        "value": "CVE-2023-37960",
        "evidence": "SECURITY-3124 / CVE-2023-37960"
      },
      {
        "value": "CVE-2023-37961",
        "evidence": "SECURITY-2988 / CVE-2023-37961"
      },
      {
        "value": "CVE-2023-37962",
        "evidence": "CVE-2023-37962 (CSRF)"
      },
      {
        "value": "CVE-2023-37963",
        "evidence": "CVE-2023-37963 (missing permission check)"
      },
      {
        "value": "CVE-2023-37964",
        "evidence": "CVE-2023-37964 (CSRF)"
      },
      {
        "value": "CVE-2023-37965",
        "evidence": "CVE-2023-37965 (missing permission check)"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-jenkins-security-advisories",
  "document_id": 23934,
  "published_at": "2023-07-12T12:00:00+00:00"
}