Jenkins Security Advisory 2020-03-09

{
  "id": "8b129b23917bc358682b187a0b71df4e8a2fcbb4268d48a69b95844df8b564d5",
  "url": "https://www.jenkins.io/security/advisory/2020-03-09/",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Jenkins Security Advisory 2020-03-09",
    "summary": "The advisory reports vulnerabilities in multiple Jenkins plugins. It provides fixed versions for some plugins and states that no fixes are available for others.",
    "evidence": "This advisory announces vulnerabilities in the following Jenkins deliverables:",
    "products": [
      {
        "name": {
          "value": "Script Security Plugin",
          "evidence": "Script Security Plugin 1.71 has additional restrictions"
        },
        "prerequisites": [
          {
            "value": "able to specify and run sandboxed scripts",
            "evidence": "This allows attackers able to specify and run sandboxed scripts"
          }
        ],
        "fixed_versions": [
          {
            "value": "1.71",
            "evidence": "Script Security Plugin 1.71 has additional restrictions"
          }
        ],
        "affected_versions": [
          {
            "value": "1.70 and earlier",
            "evidence": "Sandbox protection in Script Security Plugin 1.70 and earlier"
          }
        ]
      },
      {
        "name": {
          "value": "Git Plugin",
          "evidence": "Git Plugin 4.2.1 escapes the affected part"
        },
        "prerequisites": [
          {
            "value": "Job/Configure permission",
            "evidence": "can be exploited by users with Job/Configure permission"
          }
        ],
        "fixed_versions": [
          {
            "value": "4.2.1",
            "evidence": "Git Plugin 4.2.1 escapes the affected part"
          }
        ],
        "affected_versions": [
          {
            "value": "4.2.0 and earlier",
            "evidence": "Git Plugin 4.2.0 and earlier"
          }
        ]
      },
      {
        "name": {
          "value": "Timestamper Plugin",
          "evidence": "Timestamper Plugin 1.11.2 sanitizes the HTML formatting"
        },
        "prerequisites": [
          {
            "value": "Overall/Administer permission",
            "evidence": "can be exploited by users with Overall/Administer permission"
          }
        ],
        "fixed_versions": [
          {
            "value": "1.11.2",
            "evidence": "Timestamper Plugin 1.11.2 sanitizes the HTML formatting"
          }
        ],
        "affected_versions": [
          {
            "value": "1.11.1 and earlier",
            "evidence": "Timestamper Plugin 1.11.1 and earlier"
          }
        ]
      },
      {
        "name": {
          "value": "Cobertura Plugin",
          "evidence": "Cobertura Plugin 1.16 disables external entity resolution"
        },
        "prerequisites": [
          {
            "value": "able to control the input files",
            "evidence": "allows a user able to control the input files"
          }
        ],
        "fixed_versions": [
          {
            "value": "1.16",
            "evidence": "Cobertura Plugin 1.16 disables external entity resolution"
          }
        ],
        "affected_versions": [
          {
            "value": "1.15 and earlier",
            "evidence": "Cobertura Plugin 1.15 and earlier"
          }
        ]
      },
      {
        "name": {
          "value": "Cobertura Plugin",
          "evidence": "Cobertura Plugin 1.16 sanitizes the file paths"
        },
        "prerequisites": [
          {
            "value": "able to control the coverage report content",
            "evidence": "allows attackers able to control the coverage report content"
          }
        ],
        "fixed_versions": [
          {
            "value": "1.16",
            "evidence": "Cobertura Plugin 1.16 sanitizes the file paths"
          }
        ],
        "affected_versions": [
          {
            "value": "1.15 and earlier",
            "evidence": "Cobertura Plugin 1.15 and earlier"
          }
        ]
      },
      {
        "name": {
          "value": "Audit Trail Plugin",
          "evidence": "Audit Trail Plugin 3.3 escapes the affected part"
        },
        "prerequisites": [
          {
            "value": "Overall/Administer permission",
            "evidence": "by users with Overall/Administer permission"
          }
        ],
        "fixed_versions": [
          {
            "value": "3.3",
            "evidence": "Audit Trail Plugin 3.3 escapes the affected part"
          }
        ],
        "affected_versions": [
          {
            "value": "3.2 and earlier",
            "evidence": "Audit Trail Plugin 3.2 and earlier"
          }
        ]
      },
      {
        "name": {
          "value": "P4 Plugin",
          "evidence": "P4 Plugin 1.10.11 requires POST requests"
        },
        "prerequisites": [
          {
            "value": "Overall/Read access",
            "evidence": "This allows users with Overall/Read access"
          }
        ],
        "fixed_versions": [
          {
            "value": "1.10.11",
            "evidence": "P4 Plugin 1.10.11 requires POST requests"
          }
        ],
        "affected_versions": [
          {
            "value": "1.10.10 and earlier",
            "evidence": "P4 Plugin 1.10.10 and earlier"
          }
        ]
      },
      {
        "name": {
          "value": "Logstash Plugin",
          "evidence": "Logstash Plugin 2.3.2 transmits the credentials"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.3.2",
            "evidence": "Logstash Plugin 2.3.2 transmits the credentials in its global configuration encrypted"
          }
        ],
        "affected_versions": [
          {
            "value": "2.3.1 and earlier",
            "evidence": "by Logstash Plugin 2.3.1 and earlier"
          }
        ]
      },
      {
        "name": {
          "value": "Rundeck Plugin",
          "evidence": "Rundeck Plugin 3.6.7 disables external entity resolution"
        },
        "prerequisites": [
          {
            "value": "Overall/Read access",
            "evidence": "allows a user with Overall/Read access"
          }
        ],
        "fixed_versions": [
          {
            "value": "3.6.7",
            "evidence": "Rundeck Plugin 3.6.7 disables external entity resolution"
          }
        ],
        "affected_versions": [
          {
            "value": "3.6.6 and earlier",
            "evidence": "Rundeck Plugin 3.6.6 and earlier"
          }
        ]
      },
      {
        "name": {
          "value": "Zephyr Enterprise Test Management Plugin",
          "evidence": "Zephyr Enterprise Test Management Plugin 1.10 integrates"
        },
        "prerequisites": [
          {
            "value": "access to the Jenkins controller file system",
            "evidence": "can be viewed by users with access to the Jenkins controller file system"
          }
        ],
        "fixed_versions": [
          {
            "value": "1.10",
            "evidence": "Zephyr Enterprise Test Management Plugin 1.10 integrates with Credentials Plugin"
          }
        ],
        "affected_versions": [
          {
            "value": "1.9.1 and earlier",
            "evidence": "Zephyr Enterprise Test Management Plugin 1.9.1 and earlier"
          }
        ]
      },
      {
        "name": {
          "value": "Mac Plugin",
          "evidence": "Mac Plugin 1.2.0 validates SSH host keys"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.2.0",
            "evidence": "Mac Plugin 1.2.0 validates SSH host keys"
          }
        ],
        "affected_versions": [
          {
            "value": "1.1.0 and earlier",
            "evidence": "Mac Plugin 1.1.0 and earlier"
          }
        ]
      },
      {
        "name": {
          "value": "Mac Plugin",
          "evidence": "in Mac Plugin 1.2.0"
        },
        "prerequisites": [
          {
            "value": "Overall/Read access",
            "evidence": "allows users with Overall/Read access to Jenkins"
          }
        ],
        "fixed_versions": [
          {
            "value": "1.2.0",
            "evidence": "This form validation method requires POST requests and Overall/Administer permission in Mac Plugin 1.2.0."
          }
        ],
        "affected_versions": [
          {
            "value": "1.1.0 and earlier",
            "evidence": "Mac Plugin 1.1.0 and earlier"
          }
        ]
      },
      {
        "name": {
          "value": "Repository Connector Plugin",
          "evidence": "Repository Connector Plugin stores credentials"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "1.2.6 and earlier",
            "evidence": "by Repository Connector Plugin 1.2.6 and earlier"
          }
        ]
      },
      {
        "name": {
          "value": "Sonar Quality Gates Plugin",
          "evidence": "Sonar Quality Gates Plugin stores credentials"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "1.3.1 and earlier",
            "evidence": "by Sonar Quality Gates Plugin 1.3.1 and earlier"
          }
        ]
      },
      {
        "name": {
          "value": "Quality Gates Plugin",
          "evidence": "Quality Gates Plugin 2.5 and earlier"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "2.5 and earlier",
            "evidence": "by Quality Gates Plugin 2.5 and earlier"
          }
        ]
      },
      {
        "name": {
          "value": "Subversion Release Manager Plugin",
          "evidence": "Subversion Release Manager Plugin 1.2 and earlier"
        },
        "prerequisites": [
          {
            "value": "Job/Configure permission",
            "evidence": "by users with Job/Configure permission"
          }
        ],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "1.2 and earlier",
            "evidence": "Subversion Release Manager Plugin 1.2 and earlier"
          }
        ]
      },
      {
        "name": {
          "value": "Backlog Plugin",
          "evidence": "Backlog Plugin 2.4 and earlier"
        },
        "prerequisites": [
          {
            "value": "Extended Read permission",
            "evidence": "could be viewed by users with Extended Read permission"
          }
        ],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "2.4 and earlier",
            "evidence": "by Backlog Plugin 2.4 and earlier"
          }
        ]
      },
      {
        "name": {
          "value": "Zephyr for JIRA Test Management Plugin",
          "evidence": "Zephyr for JIRA Test Management Plugin 1.5 and earlier"
        },
        "prerequisites": [
          {
            "value": "access to the Jenkins controller file system",
            "evidence": "can be viewed by users with access to the Jenkins controller file system"
          }
        ],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "1.5 and earlier",
            "evidence": "Zephyr for JIRA Test Management Plugin 1.5 and earlier"
          }
        ]
      },
      {
        "name": {
          "value": "OpenShift Deployer Plugin",
          "evidence": "by OpenShift Deployer Plugin 1.2.0 and earlier"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "1.2.0 and earlier",
            "evidence": "by OpenShift Deployer Plugin 1.2.0 and earlier"
          }
        ]
      },
      {
        "name": {
          "value": "DeployHub Plugin",
          "evidence": "by DeployHub Plugin 8.0.14 and earlier"
        },
        "prerequisites": [
          {
            "value": "Extended Read permission",
            "evidence": "could be viewed by users with Extended Read permission"
          }
        ],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "8.0.14 and earlier",
            "evidence": "by DeployHub Plugin 8.0.14 and earlier"
          }
        ]
      },
      {
        "name": {
          "value": "Skytap Cloud CI Plugin",
          "evidence": "by Skytap Cloud CI Plugin 2.07 and earlier"
        },
        "prerequisites": [
          {
            "value": "Extended Read permission",
            "evidence": "could be viewed by users with Extended Read permission"
          }
        ],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "2.07 and earlier",
            "evidence": "by Skytap Cloud CI Plugin 2.07 and earlier"
          }
        ]
      },
      {
        "name": {
          "value": "Literate Plugin",
          "evidence": "Literate Plugin 1.0 and earlier"
        },
        "prerequisites": [
          {
            "value": "able to provide YAML input files",
            "evidence": "exploitable by users able to provide YAML input files to Literate Plugin’s build step"
          }
        ],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "1.0 and earlier",
            "evidence": "Literate Plugin 1.0 and earlier"
          }
        ]
      },
      {
        "name": {
          "value": "CryptoMove Plugin",
          "evidence": "CryptoMove Plugin 0.1.33 and earlier"
        },
        "prerequisites": [
          {
            "value": "Job/Configure permission",
            "evidence": "allowing user with Job/Configure permission"
          }
        ],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "0.1.33 and earlier",
            "evidence": "CryptoMove Plugin 0.1.33 and earlier"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2020-2134",
        "evidence": "CVE-2020-2134 (constructors)"
      },
      {
        "value": "CVE-2020-2135",
        "evidence": "CVE-2020-2135 (GroovyInterceptable)"
      },
      {
        "value": "CVE-2020-2136",
        "evidence": "CVE-2020-2136"
      },
      {
        "value": "CVE-2020-2137",
        "evidence": "CVE-2020-2137"
      },
      {
        "value": "CVE-2020-2138",
        "evidence": "CVE-2020-2138"
      },
      {
        "value": "CVE-2020-2139",
        "evidence": "CVE-2020-2139"
      },
      {
        "value": "CVE-2020-2140",
        "evidence": "CVE-2020-2140"
      },
      {
        "value": "CVE-2020-2141",
        "evidence": "CVE-2020-2141 (CSRF)"
      },
      {
        "value": "CVE-2020-2142",
        "evidence": "CVE-2020-2142 (missing permission check)"
      },
      {
        "value": "CVE-2020-2143",
        "evidence": "CVE-2020-2143"
      },
      {
        "value": "CVE-2020-2144",
        "evidence": "CVE-2020-2144"
      },
      {
        "value": "CVE-2020-2145",
        "evidence": "CVE-2020-2145"
      },
      {
        "value": "CVE-2020-2146",
        "evidence": "CVE-2020-2146"
      },
      {
        "value": "CVE-2020-2147",
        "evidence": "CVE-2020-2147 (CSRF)"
      },
      {
        "value": "CVE-2020-2148",
        "evidence": "CVE-2020-2148 (missing permission check)"
      },
      {
        "value": "CVE-2020-2149",
        "evidence": "CVE-2020-2149"
      },
      {
        "value": "CVE-2020-2150",
        "evidence": "CVE-2020-2150"
      },
      {
        "value": "CVE-2020-2151",
        "evidence": "CVE-2020-2151"
      },
      {
        "value": "CVE-2020-2152",
        "evidence": "CVE-2020-2152"
      },
      {
        "value": "CVE-2020-2153",
        "evidence": "CVE-2020-2153"
      },
      {
        "value": "CVE-2020-2154",
        "evidence": "CVE-2020-2154"
      },
      {
        "value": "CVE-2020-2155",
        "evidence": "CVE-2020-2155"
      },
      {
        "value": "CVE-2020-2156",
        "evidence": "CVE-2020-2156"
      },
      {
        "value": "CVE-2020-2157",
        "evidence": "CVE-2020-2157"
      },
      {
        "value": "CVE-2020-2158",
        "evidence": "CVE-2020-2158"
      },
      {
        "value": "CVE-2020-2159",
        "evidence": "CVE-2020-2159"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-jenkins-security-advisories",
  "document_id": 23992,
  "published_at": "2020-03-09T12:00:00+00:00"
}