Jenkins Security Advisory 2022-02-15

{
  "id": "a017c85abdf19884ce7d67c3077f2741ff84c1278c959243e65df7e638a15afc",
  "url": "https://www.jenkins.io/security/advisory/2022-02-15/",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Jenkins Security Advisory 2022-02-15",
    "summary": "The advisory reports vulnerabilities across Jenkins plugins, including command execution, arbitrary file reads, information disclosure, XSS, and permission-check issues. It lists fixed versions for several plugins; other listed issues had no fix available at publication.",
    "evidence": "Jenkins Security Advisory 2022-02-15",
    "products": [
      {
        "name": {
          "value": "Agent Server Parameter Plugin",
          "evidence": "Agent Server Parameter Plugin should be updated to version 1.1"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.1",
            "evidence": "Agent Server Parameter Plugin should be updated to version 1.1"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.0",
            "evidence": "Agent Server Parameter Plugin up to and including 1.0"
          }
        ]
      },
      {
        "name": {
          "value": "autonomiq Plugin",
          "evidence": "autonomiq Plugin should be updated to version 1.16"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.16",
            "evidence": "autonomiq Plugin should be updated to version 1.16"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.15",
            "evidence": "autonomiq Plugin up to and including 1.15"
          }
        ]
      },
      {
        "name": {
          "value": "Checkmarx Plugin",
          "evidence": "Checkmarx Plugin up to and including 2022.1.2"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 2022.1.2",
            "evidence": "Checkmarx Plugin up to and including 2022.1.2"
          }
        ]
      },
      {
        "name": {
          "value": "Conjur Secrets Plugin",
          "evidence": "Conjur Secrets Plugin should be updated to version 1.0.12"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.0.12",
            "evidence": "Conjur Secrets Plugin should be updated to version 1.0.12"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.0.11",
            "evidence": "Conjur Secrets Plugin up to and including 1.0.11"
          }
        ]
      },
      {
        "name": {
          "value": "Convertigo Mobile Platform Plugin",
          "evidence": "Convertigo Mobile Platform Plugin up to and including 1.1"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 1.1",
            "evidence": "Convertigo Mobile Platform Plugin up to and including 1.1"
          }
        ]
      },
      {
        "name": {
          "value": "Custom Checkbox Parameter Plugin",
          "evidence": "Custom Checkbox Parameter Plugin should be updated to version 1.2"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.2",
            "evidence": "Custom Checkbox Parameter Plugin should be updated to version 1.2"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.1",
            "evidence": "Custom Checkbox Parameter Plugin up to and including 1.1"
          }
        ]
      },
      {
        "name": {
          "value": "dbCharts Plugin",
          "evidence": "dbCharts Plugin up to and including 0.5.2"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 0.5.2",
            "evidence": "dbCharts Plugin up to and including 0.5.2"
          }
        ]
      },
      {
        "name": {
          "value": "Doktor Plugin",
          "evidence": "Doktor Plugin up to and including 0.4.1"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 0.4.1",
            "evidence": "Doktor Plugin up to and including 0.4.1"
          }
        ]
      },
      {
        "name": {
          "value": "Fortify Plugin",
          "evidence": "Fortify Plugin should be updated to version 20.2.35"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "20.2.35",
            "evidence": "Fortify Plugin should be updated to version 20.2.35"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 20.2.34",
            "evidence": "Fortify Plugin up to and including 20.2.34"
          }
        ]
      },
      {
        "name": {
          "value": "Generic Webhook Trigger Plugin",
          "evidence": "Generic Webhook Trigger Plugin should be updated to version 1.82"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.82",
            "evidence": "Generic Webhook Trigger Plugin should be updated to version 1.82"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.81",
            "evidence": "Generic Webhook Trigger Plugin up to and including 1.81"
          }
        ]
      },
      {
        "name": {
          "value": "GitLab Authentication Plugin",
          "evidence": "GitLab Authentication Plugin up to and including 1.13"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 1.13",
            "evidence": "GitLab Authentication Plugin up to and including 1.13"
          }
        ]
      },
      {
        "name": {
          "value": "HashiCorp Vault Plugin",
          "evidence": "HashiCorp Vault Plugin should be updated to version 336.v182c0fbaaeb7"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "336.v182c0fbaaeb7",
            "evidence": "HashiCorp Vault Plugin should be updated to version 336.v182c0fbaaeb7"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 3.8.0",
            "evidence": "HashiCorp Vault Plugin up to and including 3.8.0"
          },
          {
            "value": "up to and including 336.v182c0fbaaeb7",
            "evidence": "HashiCorp Vault Plugin up to and including 336.v182c0fbaaeb7"
          }
        ]
      },
      {
        "name": {
          "value": "Pipeline: Build Step Plugin",
          "evidence": "Pipeline: Build Step Plugin should be updated to version 2.15.1"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.15.1",
            "evidence": "Pipeline: Build Step Plugin should be updated to version 2.15.1"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 2.15",
            "evidence": "Pipeline: Build Step Plugin up to and including 2.15"
          }
        ]
      },
      {
        "name": {
          "value": "Pipeline: Deprecated Groovy Libraries Plugin",
          "evidence": "Pipeline: Deprecated Groovy Libraries Plugin should be updated to version 561.va_ce0de3c2d69"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "561.va_ce0de3c2d69",
            "evidence": "Pipeline: Deprecated Groovy Libraries Plugin should be updated to version 561.va_ce0de3c2d69"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 552.vd9cc05b8a2e1",
            "evidence": "Pipeline: Deprecated Groovy Libraries Plugin up to and including 552.vd9cc05b8a2e1"
          }
        ]
      },
      {
        "name": {
          "value": "Pipeline: Groovy Plugin",
          "evidence": "Pipeline: Groovy Plugin should be updated to version 2656.vf7a_e7b_75a_457"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2656.vf7a_e7b_75a_457",
            "evidence": "Pipeline: Groovy Plugin should be updated to version 2656.vf7a_e7b_75a_457"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 2648.va9433432b33c",
            "evidence": "Pipeline: Groovy Plugin up to and including 2648.va9433432b33c"
          }
        ]
      },
      {
        "name": {
          "value": "Pipeline: Multibranch Plugin",
          "evidence": "Pipeline: Multibranch Plugin should be updated to version 707.v71c3f0a_6ccdb_"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "707.v71c3f0a_6ccdb_",
            "evidence": "Pipeline: Multibranch Plugin should be updated to version 707.v71c3f0a_6ccdb_"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 706.vd43c65dec013",
            "evidence": "Pipeline: Multibranch Plugin up to and including 706.vd43c65dec013"
          }
        ]
      },
      {
        "name": {
          "value": "Promoted Builds (Simple) Plugin",
          "evidence": "Promoted Builds (Simple) Plugin up to and including 1.9"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 1.9",
            "evidence": "Promoted Builds (Simple) Plugin up to and including 1.9"
          }
        ]
      },
      {
        "name": {
          "value": "SCP publisher Plugin",
          "evidence": "SCP publisher Plugin up to and including 1.8"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 1.8",
            "evidence": "SCP publisher Plugin up to and including 1.8"
          }
        ]
      },
      {
        "name": {
          "value": "Chef Sinatra Plugin",
          "evidence": "Chef Sinatra Plugin up to and including 1.20"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 1.20",
            "evidence": "Chef Sinatra Plugin up to and including 1.20"
          }
        ]
      },
      {
        "name": {
          "value": "Snow Commander Plugin",
          "evidence": "Snow Commander Plugin should be updated to version 2.0"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.0",
            "evidence": "Snow Commander Plugin should be updated to version 2.0"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.10",
            "evidence": "Snow Commander Plugin up to and including 1.10"
          }
        ]
      },
      {
        "name": {
          "value": "Support Core Plugin",
          "evidence": "Support Core Plugin should be updated to version 2.79.1"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.79.1",
            "evidence": "Support Core Plugin should be updated to version 2.79.1"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 2.79",
            "evidence": "Support Core Plugin up to and including 2.79"
          }
        ]
      },
      {
        "name": {
          "value": "SWAMP Plugin",
          "evidence": "SWAMP Plugin up to and including 1.2.6"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 1.2.6",
            "evidence": "SWAMP Plugin up to and including 1.2.6"
          }
        ]
      },
      {
        "name": {
          "value": "Team Views Plugin",
          "evidence": "Team Views Plugin up to and including 0.9.0"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 0.9.0",
            "evidence": "Team Views Plugin up to and including 0.9.0"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2022-25173",
        "evidence": "SECURITY-2463 / CVE-2022-25173"
      },
      {
        "value": "CVE-2022-25174",
        "evidence": "CVE-2022-25174 (Pipeline: Shared Groovy Libraries)"
      },
      {
        "value": "CVE-2022-25175",
        "evidence": "CVE-2022-25175 (Pipeline: Multibranch)"
      },
      {
        "value": "CVE-2022-25176",
        "evidence": "SECURITY-2613 / CVE-2022-25176"
      },
      {
        "value": "CVE-2022-25177",
        "evidence": "CVE-2022-25177 (Pipeline: Shared Groovy Libraries)"
      },
      {
        "value": "CVE-2022-25178",
        "evidence": "CVE-2022-25178 (Pipeline: Shared Groovy Libraries)"
      },
      {
        "value": "CVE-2022-25179",
        "evidence": "CVE-2022-25179 (Pipeline: Multibranch)"
      },
      {
        "value": "CVE-2022-25180",
        "evidence": "SECURITY-2443 / CVE-2022-25180"
      },
      {
        "value": "CVE-2022-25181",
        "evidence": "SECURITY-2441 / CVE-2022-25181"
      },
      {
        "value": "CVE-2022-25182",
        "evidence": "SECURITY-2422 / CVE-2022-25182"
      },
      {
        "value": "CVE-2022-25183",
        "evidence": "SECURITY-2586 / CVE-2022-25183"
      },
      {
        "value": "CVE-2022-25184",
        "evidence": "SECURITY-2519 / CVE-2022-25184"
      },
      {
        "value": "CVE-2022-25185",
        "evidence": "SECURITY-2592 / CVE-2022-25185"
      },
      {
        "value": "CVE-2022-25186",
        "evidence": "SECURITY-2429 / CVE-2022-25186"
      },
      {
        "value": "CVE-2022-25187",
        "evidence": "SECURITY-2186 / CVE-2022-25187"
      },
      {
        "value": "CVE-2022-25188",
        "evidence": "SECURITY-2214 / CVE-2022-25188"
      },
      {
        "value": "CVE-2022-25189",
        "evidence": "SECURITY-2266 / CVE-2022-25189"
      },
      {
        "value": "CVE-2022-25190",
        "evidence": "SECURITY-2350 / CVE-2022-25190"
      },
      {
        "value": "CVE-2022-25191",
        "evidence": "SECURITY-2268 / CVE-2022-25191"
      },
      {
        "value": "CVE-2022-25192",
        "evidence": "CVE-2022-25192 (CSRF)"
      },
      {
        "value": "CVE-2022-25193",
        "evidence": "CVE-2022-25193 (missing permission check)"
      },
      {
        "value": "CVE-2022-25194",
        "evidence": "CVE-2022-25194 (CSRF)"
      },
      {
        "value": "CVE-2022-25195",
        "evidence": "CVE-2022-25195 (missing permission check)"
      },
      {
        "value": "CVE-2022-25196",
        "evidence": "SECURITY-1833 / CVE-2022-25196"
      },
      {
        "value": "CVE-2022-25197",
        "evidence": "SECURITY-2521 / CVE-2022-25197"
      },
      {
        "value": "CVE-2022-25198",
        "evidence": "CVE-2022-25198 (CSRF)"
      },
      {
        "value": "CVE-2022-25199",
        "evidence": "CVE-2022-25199 (missing permission check)"
      },
      {
        "value": "CVE-2022-25200",
        "evidence": "CVE-2022-25200 (CSRF)"
      },
      {
        "value": "CVE-2022-25201",
        "evidence": "CVE-2022-25201 (missing permission check)"
      },
      {
        "value": "CVE-2022-25202",
        "evidence": "SECURITY-2334 / CVE-2022-25202"
      },
      {
        "value": "CVE-2022-25203",
        "evidence": "SECURITY-2324 / CVE-2022-25203"
      },
      {
        "value": "CVE-2022-25204",
        "evidence": "SECURITY-2548 / CVE-2022-25204"
      },
      {
        "value": "CVE-2022-25205",
        "evidence": "CVE-2022-25205 (CSRF)"
      },
      {
        "value": "CVE-2022-25206",
        "evidence": "CVE-2022-25206 (missing permission check)"
      },
      {
        "value": "CVE-2022-25207",
        "evidence": "CVE-2022-25207 (CSRF)"
      },
      {
        "value": "CVE-2022-25208",
        "evidence": "CVE-2022-25208 (missing permission check)"
      },
      {
        "value": "CVE-2022-25209",
        "evidence": "CVE-2022-25209 (XXE)"
      },
      {
        "value": "CVE-2022-25210",
        "evidence": "SECURITY-2280 / CVE-2022-25210"
      },
      {
        "value": "CVE-2022-25211",
        "evidence": "CVE-2022-25211 (missing permission check)"
      },
      {
        "value": "CVE-2022-25212",
        "evidence": "CVE-2022-25212 (CSRF)"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-jenkins-security-advisories",
  "document_id": 23956,
  "published_at": "2022-02-15T12:00:00+00:00"
}