Jenkins Security Advisory 2023-08-16

{
  "id": "1ae27d721618066eacd89103af229d1ef6d0a2809ddb05062578879b105dd2ff",
  "url": "https://www.jenkins.io/security/advisory/2023-08-16/",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Jenkins Security Advisory 2023-08-16",
    "summary": "The advisory describes vulnerabilities in Jenkins plugins, including CSRF, credential exposure, information disclosure, and cross-site scripting. It provides fixed versions for some plugins; no fixes were available for others at publication.",
    "evidence": "Jenkins Security Advisory 2023-08-16",
    "products": [
      {
        "name": {
          "value": "Blue Ocean Plugin",
          "evidence": "Blue Ocean Plugin should be updated to version 1.27.5.1"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.27.5.1",
            "evidence": "Blue Ocean Plugin should be updated to version 1.27.5.1"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.27.5",
            "evidence": "Blue Ocean Plugin up to and including 1.27.5"
          }
        ]
      },
      {
        "name": {
          "value": "Config File Provider Plugin",
          "evidence": "Config File Provider Plugin should be updated to version 953.v0432a_802e4d2"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "953.v0432a_802e4d2",
            "evidence": "Config File Provider Plugin should be updated to version 953.v0432a_802e4d2"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 952.va_544a_6234b_46",
            "evidence": "Config File Provider Plugin up to and including 952.va_544a_6234b_46"
          }
        ]
      },
      {
        "name": {
          "value": "Delphix Plugin",
          "evidence": "Delphix Plugin should be updated to version 3.0.3"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "3.0.3",
            "evidence": "Delphix Plugin should be updated to version 3.0.3"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 3.0.2",
            "evidence": "Delphix Plugin up to and including 3.0.2"
          }
        ]
      },
      {
        "name": {
          "value": "Docker Swarm Plugin",
          "evidence": "Docker Swarm Plugin"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 1.11",
            "evidence": "Docker Swarm Plugin up to and including 1.11"
          }
        ]
      },
      {
        "name": {
          "value": "Favorite View Plugin",
          "evidence": "Favorite View Plugin"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 5.v77a_37f62782d",
            "evidence": "Favorite View Plugin up to and including 5.v77a_37f62782d"
          }
        ]
      },
      {
        "name": {
          "value": "Flaky Test Handler Plugin",
          "evidence": "Flaky Test Handler Plugin should be updated to version 1.2.3"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.2.3",
            "evidence": "Flaky Test Handler Plugin should be updated to version 1.2.3"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.2.2",
            "evidence": "Flaky Test Handler Plugin up to and including 1.2.2"
          }
        ]
      },
      {
        "name": {
          "value": "Folders Plugin",
          "evidence": "Folders Plugin should be updated to version 6.848.ve3b_fd7839a_81"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "6.848.ve3b_fd7839a_81",
            "evidence": "Folders Plugin should be updated to version 6.848.ve3b_fd7839a_81"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 6.846.v23698686f0f6",
            "evidence": "Folders Plugin up to and including 6.846.v23698686f0f6"
          }
        ]
      },
      {
        "name": {
          "value": "Fortify Plugin",
          "evidence": "Fortify Plugin should be updated to version 22.2.39"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "22.2.39",
            "evidence": "Fortify Plugin should be updated to version 22.2.39"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 22.1.38",
            "evidence": "Fortify Plugin up to and including 22.1.38"
          }
        ]
      },
      {
        "name": {
          "value": "Gogs Plugin",
          "evidence": "Gogs Plugin"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 1.0.15",
            "evidence": "Gogs Plugin up to and including 1.0.15"
          }
        ]
      },
      {
        "name": {
          "value": "Maven Artifact ChoiceListProvider (Nexus) Plugin",
          "evidence": "Maven Artifact ChoiceListProvider (Nexus) Plugin"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 1.14",
            "evidence": "Maven Artifact ChoiceListProvider (Nexus) Plugin up to and including 1.14"
          }
        ]
      },
      {
        "name": {
          "value": "NodeJS Plugin",
          "evidence": "NodeJS Plugin should be updated to version 1.6.0.1"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.6.0.1",
            "evidence": "NodeJS Plugin should be updated to version 1.6.0.1"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.6.0",
            "evidence": "NodeJS Plugin up to and including 1.6.0"
          }
        ]
      },
      {
        "name": {
          "value": "Shortcut Job Plugin",
          "evidence": "Shortcut Job Plugin should be updated to version 0.5"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.5",
            "evidence": "Shortcut Job Plugin should be updated to version 0.5"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 0.4",
            "evidence": "Shortcut Job Plugin up to and including 0.4"
          }
        ]
      },
      {
        "name": {
          "value": "Tuleap Authentication Plugin",
          "evidence": "Tuleap Authentication Plugin should be updated to version 1.1.21"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.1.21",
            "evidence": "Tuleap Authentication Plugin should be updated to version 1.1.21"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.1.20",
            "evidence": "Tuleap Authentication Plugin up to and including 1.1.20"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2023-40336",
        "evidence": "SECURITY-3106 / CVE-2023-40336"
      },
      {
        "value": "CVE-2023-40337",
        "evidence": "SECURITY-3105 / CVE-2023-40337"
      },
      {
        "value": "CVE-2023-40338",
        "evidence": "SECURITY-3109 / CVE-2023-40338"
      },
      {
        "value": "CVE-2023-40339",
        "evidence": "SECURITY-3090 / CVE-2023-40339"
      },
      {
        "value": "CVE-2023-40340",
        "evidence": "SECURITY-3196 / CVE-2023-40340"
      },
      {
        "value": "CVE-2023-40341",
        "evidence": "SECURITY-3116 / CVE-2023-40341"
      },
      {
        "value": "CVE-2023-4301",
        "evidence": "CVE-2023-4301 (CSRF)"
      },
      {
        "value": "CVE-2023-4302",
        "evidence": "CVE-2023-4302 (missing permission check)"
      },
      {
        "value": "CVE-2023-4303",
        "evidence": "SECURITY-3140 / CVE-2023-4303"
      },
      {
        "value": "CVE-2023-40342",
        "evidence": "SECURITY-3223 / CVE-2023-40342"
      },
      {
        "value": "CVE-2023-40343",
        "evidence": "SECURITY-3229 / CVE-2023-40343"
      },
      {
        "value": "CVE-2023-40344",
        "evidence": "SECURITY-3214 (1) / CVE-2023-40344"
      },
      {
        "value": "CVE-2023-40345",
        "evidence": "SECURITY-3214 (2) / CVE-2023-40345"
      },
      {
        "value": "CVE-2023-40346",
        "evidence": "SECURITY-3071 / CVE-2023-40346"
      },
      {
        "value": "CVE-2023-40347",
        "evidence": "SECURITY-3153 / CVE-2023-40347"
      },
      {
        "value": "CVE-2023-40348",
        "evidence": "CVE-2023-40348 (information disclosure)"
      },
      {
        "value": "CVE-2023-40349",
        "evidence": "CVE-2023-40349 (insecure default)"
      },
      {
        "value": "CVE-2023-40350",
        "evidence": "SECURITY-2811 / CVE-2023-40350"
      },
      {
        "value": "CVE-2023-40351",
        "evidence": "SECURITY-3201 / CVE-2023-40351"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-jenkins-security-advisories",
  "document_id": 23931,
  "published_at": "2023-08-16T12:00:00+00:00"
}