Jenkins Security Advisory 2023-09-06

{
  "id": "3afbb1436cdd80e37fbaeca2dc3bf55bb9f5cd234e49c0ec2030fcb7623ce847",
  "url": "https://www.jenkins.io/security/advisory/2023-09-06/",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Jenkins Security Advisory 2023-09-06",
    "summary": "The Jenkins advisory describes vulnerabilities across multiple plugins. Fixes are available for seven plugins; the advisory says no fixes were available for the other affected plugins at publication.",
    "evidence": "These versions include fixes to the vulnerabilities described above.",
    "products": [
      {
        "name": {
          "value": "Job Configuration History Plugin",
          "evidence": "Job Configuration History Plugin should be updated to version 1229.v3039470161a_d"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1229.v3039470161a_d",
            "evidence": "Job Configuration History Plugin should be updated to version 1229.v3039470161a_d"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1227.v7a_79fc4dc01f",
            "evidence": "Job Configuration History Plugin up to and including 1227.v7a_79fc4dc01f"
          }
        ]
      },
      {
        "name": {
          "value": "Pipeline Maven Integration Plugin",
          "evidence": "Pipeline Maven Integration Plugin should be updated to version 1331.v003efa_fd6e81"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1331.v003efa_fd6e81",
            "evidence": "Pipeline Maven Integration Plugin should be updated to version 1331.v003efa_fd6e81"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1330.v18e473854496",
            "evidence": "Pipeline Maven Integration Plugin up to and including 1330.v18e473854496"
          }
        ]
      },
      {
        "name": {
          "value": "Microsoft Entra ID (previously Azure AD) Plugin",
          "evidence": "Microsoft Entra ID (previously Azure AD) Plugin should be updated to version 397.v907382dd9b_98 or 378.380.v545b_1154b_3fb_"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "397.v907382dd9b_98",
            "evidence": "Microsoft Entra ID (previously Azure AD) Plugin should be updated to version 397.v907382dd9b_98 or 378.380.v545b_1154b_3fb_"
          },
          {
            "value": "378.380.v545b_1154b_3fb_",
            "evidence": "Microsoft Entra ID (previously Azure AD) Plugin should be updated to version 397.v907382dd9b_98 or 378.380.v545b_1154b_3fb_"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 396.v86ce29279947",
            "evidence": "Microsoft Entra ID (previously Azure AD) Plugin up to and including 396.v86ce29279947"
          }
        ]
      },
      {
        "name": {
          "value": "Google Login Plugin",
          "evidence": "Google Login Plugin should be updated to version 1.8"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.8",
            "evidence": "Google Login Plugin should be updated to version 1.8"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.7",
            "evidence": "Google Login Plugin up to and including 1.7"
          }
        ]
      },
      {
        "name": {
          "value": "Bitbucket Push and Pull Request Plugin",
          "evidence": "Bitbucket Push and Pull Request Plugin should be updated to version 2.8.4"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.8.4",
            "evidence": "Bitbucket Push and Pull Request Plugin should be updated to version 2.8.4"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 2.8.3",
            "evidence": "Bitbucket Push and Pull Request Plugin up to and including 2.8.3"
          }
        ]
      },
      {
        "name": {
          "value": "Qualys Container Scanning Connector Plugin",
          "evidence": "Qualys Container Scanning Connector Plugin should be updated to version 1.6.2.7"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.6.2.7",
            "evidence": "Qualys Container Scanning Connector Plugin should be updated to version 1.6.2.7"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.6.2.6",
            "evidence": "Qualys Container Scanning Connector Plugin up to and including 1.6.2.6"
          }
        ]
      },
      {
        "name": {
          "value": "SSH2 Easy Plugin",
          "evidence": "SSH2 Easy Plugin should be updated to version 1.6"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.6",
            "evidence": "SSH2 Easy Plugin should be updated to version 1.6"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.4",
            "evidence": "SSH2 Easy Plugin up to and including 1.4"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2023-41930",
        "evidence": "SECURITY-3233 / CVE-2023-41930 (path traversal), CVE-2023-41931 (XSS)"
      },
      {
        "value": "CVE-2023-41931",
        "evidence": "SECURITY-3233 / CVE-2023-41930 (path traversal), CVE-2023-41931 (XSS)"
      },
      {
        "value": "CVE-2023-41932",
        "evidence": "SECURITY-3235 / CVE-2023-41932 (path traversal), CVE-2023-41933 (XXE)"
      },
      {
        "value": "CVE-2023-41933",
        "evidence": "SECURITY-3235 / CVE-2023-41932 (path traversal), CVE-2023-41933 (XXE)"
      },
      {
        "value": "CVE-2023-41934",
        "evidence": "SECURITY-3257 / CVE-2023-41934"
      },
      {
        "value": "CVE-2023-41935",
        "evidence": "SECURITY-3227 / CVE-2023-41935"
      },
      {
        "value": "CVE-2023-41936",
        "evidence": "SECURITY-3228 / CVE-2023-41936"
      },
      {
        "value": "CVE-2023-41937",
        "evidence": "SECURITY-3165 / CVE-2023-41937"
      },
      {
        "value": "CVE-2023-4777",
        "evidence": "SECURITY-3018 / CVE-2023-4777"
      },
      {
        "value": "CVE-2022-46751",
        "evidence": "SECURITY-2924 / CVE-2022-46751"
      },
      {
        "value": "CVE-2023-41938",
        "evidence": "SECURITY-3093 / CVE-2023-41938"
      },
      {
        "value": "CVE-2023-41939",
        "evidence": "SECURITY-3064 / CVE-2023-41939"
      },
      {
        "value": "CVE-2023-41940",
        "evidence": "SECURITY-3190 / CVE-2023-41940"
      },
      {
        "value": "CVE-2023-41941",
        "evidence": "SECURITY-3101 (1) / CVE-2023-41941"
      },
      {
        "value": "CVE-2023-41942",
        "evidence": "SECURITY-3101 (2) / CVE-2023-41942 (CSRF), CVE-2023-41943 (permission check)"
      },
      {
        "value": "CVE-2023-41943",
        "evidence": "SECURITY-3101 (2) / CVE-2023-41942 (CSRF), CVE-2023-41943 (permission check)"
      },
      {
        "value": "CVE-2023-41944",
        "evidence": "SECURITY-3102 / CVE-2023-41944"
      },
      {
        "value": "CVE-2023-41945",
        "evidence": "SECURITY-3065 / CVE-2023-41945"
      },
      {
        "value": "CVE-2023-41946",
        "evidence": "SECURITY-3082 / CVE-2023-41946 (CSRF), CVE-2023-41947 (permission check)"
      },
      {
        "value": "CVE-2023-41947",
        "evidence": "SECURITY-3082 / CVE-2023-41946 (CSRF), CVE-2023-41947 (permission check)"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-jenkins-security-advisories",
  "document_id": 23932,
  "published_at": "2023-09-06T12:00:00+00:00"
}