Jenkins Security Advisory 2023-07-26

{
  "id": "7f657395ef37bdbd349717dd11049860223beb1e97965dc16bcf6ec88b2afc7e",
  "url": "https://www.jenkins.io/security/advisory/2023-07-26/",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Jenkins Security Advisory 2023-07-26",
    "summary": "The advisory reports vulnerabilities in Jenkins core and several plugins. Fixes are listed for Jenkins core, GitLab Authentication Plugin, Gradle Plugin, Qualys Web App Scanning Connector Plugin, and ServiceNow DevOps Plugin. No fixes are available for Bazaar Plugin or Chef Identity Plugin.",
    "evidence": "These versions include fixes to the vulnerabilities described above.",
    "products": [
      {
        "name": {
          "value": "Jenkins",
          "evidence": "Jenkins (core)"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.416",
            "evidence": "Jenkins weekly should be updated to version 2.416"
          },
          {
            "value": "2.401.3",
            "evidence": "Jenkins LTS should be updated to version 2.401.3 or 2.414.1"
          },
          {
            "value": "2.414.1",
            "evidence": "Jenkins LTS should be updated to version 2.401.3 or 2.414.1"
          }
        ],
        "affected_versions": [
          {
            "value": "Jenkins weekly up to and including 2.415",
            "evidence": "Jenkins weekly up to and including 2.415"
          },
          {
            "value": "Jenkins LTS up to and including 2.401.2",
            "evidence": "Jenkins LTS up to and including 2.401.2"
          }
        ]
      },
      {
        "name": {
          "value": "Bazaar Plugin",
          "evidence": "Bazaar Plugin"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "Bazaar Plugin up to and including 1.22",
            "evidence": "Bazaar Plugin up to and including 1.22"
          }
        ]
      },
      {
        "name": {
          "value": "Chef Identity Plugin",
          "evidence": "Chef Identity Plugin"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "Chef Identity Plugin up to and including 2.0.3",
            "evidence": "Chef Identity Plugin up to and including 2.0.3"
          }
        ]
      },
      {
        "name": {
          "value": "GitLab Authentication Plugin",
          "evidence": "GitLab Authentication Plugin"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.18",
            "evidence": "GitLab Authentication Plugin should be updated to version 1.18"
          }
        ],
        "affected_versions": [
          {
            "value": "1.17.1 and earlier",
            "evidence": "GitLab Authentication Plugin 1.17.1 and earlier"
          }
        ]
      },
      {
        "name": {
          "value": "Gradle Plugin",
          "evidence": "Gradle Plugin"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.8.1",
            "evidence": "Gradle Plugin should be updated to version 2.8.1"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 2.8",
            "evidence": "Gradle Plugin up to and including 2.8"
          }
        ]
      },
      {
        "name": {
          "value": "Qualys Web App Scanning Connector Plugin",
          "evidence": "Qualys Web App Scanning Connector Plugin"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.0.11",
            "evidence": "Qualys Web App Scanning Connector Plugin should be updated to version 2.0.11"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 2.0.10",
            "evidence": "Qualys Web App Scanning Connector Plugin up to and including 2.0.10"
          }
        ]
      },
      {
        "name": {
          "value": "ServiceNow DevOps Plugin",
          "evidence": "ServiceNow DevOps Plugin"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.38.1",
            "evidence": "ServiceNow DevOps Plugin should be updated to version 1.38.1"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.38.0",
            "evidence": "ServiceNow DevOps Plugin up to and including 1.38.0"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2023-39151",
        "evidence": "SECURITY-3188 / CVE-2023-39151"
      },
      {
        "value": "CVE-2023-39152",
        "evidence": "SECURITY-3208 / CVE-2023-39152"
      },
      {
        "value": "CVE-2023-39153",
        "evidence": "SECURITY-2696 / CVE-2023-39153"
      },
      {
        "value": "CVE-2023-3414",
        "evidence": "CVE-2023-3414 (CSRF)"
      },
      {
        "value": "CVE-2023-3442",
        "evidence": "CVE-2023-3442 (missing permission check)"
      },
      {
        "value": "CVE-2023-39154",
        "evidence": "SECURITY-3012 / CVE-2023-39154"
      },
      {
        "value": "CVE-2023-39155",
        "evidence": "SECURITY-3192 / CVE-2023-39155"
      },
      {
        "value": "CVE-2023-39156",
        "evidence": "SECURITY-3095 / CVE-2023-39156"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-jenkins-security-advisories",
  "document_id": 23933,
  "published_at": "2023-07-26T12:00:00+00:00"
}