Jenkins Security Advisory 2021-02-24

{
  "id": "62e58d84886b2f5dd5f23ae5388c71f8816c32dc17c11c4852ef46a6f4700a82",
  "url": "https://www.jenkins.io/security/advisory/2021-02-24/",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Jenkins Security Advisory 2021-02-24",
    "summary": "The advisory describes vulnerabilities in six Jenkins plugins and provides fixed versions for each.",
    "evidence": "These versions include fixes to the vulnerabilities described above.",
    "products": [
      {
        "name": {
          "value": "Active Choices Plugin",
          "evidence": "Active Choices Plugin 2.5.3"
        },
        "prerequisites": [
          {
            "value": "Job/Configure permission",
            "evidence": "exploitable by attackers with Job/Configure permission"
          }
        ],
        "fixed_versions": [
          {
            "value": "2.5.3",
            "evidence": "Active Choices Plugin should be updated to version 2.5.3"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 2.5.2",
            "evidence": "Active Choices Plugin up to and including 2.5.2"
          }
        ]
      },
      {
        "name": {
          "value": "Artifact Repository Parameter Plugin",
          "evidence": "Artifact Repository Parameter Plugin 1.0.1"
        },
        "prerequisites": [
          {
            "value": "Job/Configure permission",
            "evidence": "exploitable by attackers with Job/Configure permission"
          }
        ],
        "fixed_versions": [
          {
            "value": "1.0.1",
            "evidence": "Artifact Repository Parameter Plugin should be updated to version 1.0.1"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.0.0",
            "evidence": "Artifact Repository Parameter Plugin up to and including 1.0.0"
          }
        ]
      },
      {
        "name": {
          "value": "Claim Plugin",
          "evidence": "Claim Plugin 2.18.2"
        },
        "prerequisites": [
          {
            "value": "able to control the display names of Jenkins users",
            "evidence": "exploitable by attackers who are able to control the display names of Jenkins users"
          }
        ],
        "fixed_versions": [
          {
            "value": "2.18.2",
            "evidence": "Claim Plugin should be updated to version 2.18.2"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 2.18.1",
            "evidence": "Claim Plugin up to and including 2.18.1"
          }
        ]
      },
      {
        "name": {
          "value": "Configuration Slicing Plugin",
          "evidence": "Configuration Slicing Plugin 1.52"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.52",
            "evidence": "Configuration Slicing Plugin should be updated to version 1.52"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.51",
            "evidence": "Configuration Slicing Plugin up to and including 1.51"
          }
        ]
      },
      {
        "name": {
          "value": "Repository Connector Plugin",
          "evidence": "Repository Connector Plugin 2.0.3"
        },
        "prerequisites": [
          {
            "value": "Item/Configure permission",
            "evidence": "exploitable by attackers with Item/Configure permission"
          }
        ],
        "fixed_versions": [
          {
            "value": "2.0.3",
            "evidence": "Repository Connector Plugin should be updated to version 2.0.3"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 2.0.2",
            "evidence": "Repository Connector Plugin up to and including 2.0.2"
          }
        ]
      },
      {
        "name": {
          "value": "Support Core Plugin",
          "evidence": "Support Core Plugin 2.72.1"
        },
        "prerequisites": [
          {
            "value": "access to support bundle content and the Jenkins instance",
            "evidence": "Attackers with access to support bundle content and the Jenkins instance could use this information"
          }
        ],
        "fixed_versions": [
          {
            "value": "2.72.1",
            "evidence": "Support Core Plugin should be updated to version 2.72.1"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 2.72",
            "evidence": "Support Core Plugin up to and including 2.72"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2021-21616",
        "evidence": "SECURITY-2192 / CVE-2021-21616"
      },
      {
        "value": "CVE-2021-21617",
        "evidence": "SECURITY-2003 / CVE-2021-21617"
      },
      {
        "value": "CVE-2021-21618",
        "evidence": "SECURITY-2183 / CVE-2021-21618"
      },
      {
        "value": "CVE-2021-21619",
        "evidence": "SECURITY-2188 (1) / CVE-2021-21619"
      },
      {
        "value": "CVE-2021-21620",
        "evidence": "SECURITY-2188 (2) / CVE-2021-21620"
      },
      {
        "value": "CVE-2021-21621",
        "evidence": "SECURITY-2150 / CVE-2021-21621"
      },
      {
        "value": "CVE-2021-21622",
        "evidence": "SECURITY-2168 / CVE-2021-21622"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-jenkins-security-advisories",
  "document_id": 23974,
  "published_at": "2021-02-24T12:00:00+00:00"
}