Jenkins Security Advisory 2022-09-21

{
  "id": "b8ad3de9c8631349f125777790e62d3ca3822368e3fa3b23c0cfa311928ca3a7",
  "url": "https://www.jenkins.io/security/advisory/2022-09-21/",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Jenkins Security Advisory 2022-09-21",
    "summary": "The advisory reports security vulnerabilities across Jenkins and multiple plugins. Fixes are available for Jenkins 2.370, Anchore Container Image Scanner Plugin 1.0.25, BMC AMI Common Configuration Plugin 1.0.15, and NS-ND Integration Performance Publisher Plugin 4.8.0.130; it states that other listed vulnerabilities have no fix available as of publication.",
    "evidence": "Jenkins Security Advisory 2022-09-21",
    "products": [
      {
        "name": {
          "value": "Jenkins (core)",
          "evidence": "This advisory announces vulnerabilities in the following Jenkins deliverables: Jenkins (core)"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.370",
            "evidence": "Jenkins weekly should be updated to version 2.370"
          }
        ],
        "affected_versions": [
          {
            "value": "Jenkins weekly up to and including 2.369",
            "evidence": "Jenkins weekly up to and including 2.369"
          }
        ]
      },
      {
        "name": {
          "value": "Anchore Container Image Scanner Plugin",
          "evidence": "Anchore Container Image Scanner Plugin 1.0.25 escapes content provided by the Anchore engine API."
        },
        "prerequisites": [
          {
            "value": "attackers able to control API responses by Anchore engine",
            "evidence": "exploitable by attackers able to control API responses by Anchore engine."
          }
        ],
        "fixed_versions": [
          {
            "value": "1.0.25",
            "evidence": "Anchore Container Image Scanner Plugin should be updated to version 1.0.25"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.0.24",
            "evidence": "Anchore Container Image Scanner Plugin up to and including 1.0.24"
          }
        ]
      },
      {
        "name": {
          "value": "BMC AMI Common Configuration Plugin",
          "evidence": "BMC AMI Common Configuration Plugin 1.0.15 disables external entity resolution for its XML parser."
        },
        "prerequisites": [
          {
            "value": "attackers able to change the contents of the Topaz Workbench CLI home directory on agents",
            "evidence": "This allows attackers able to change the contents of the Topaz Workbench CLI home directory on agents"
          }
        ],
        "fixed_versions": [
          {
            "value": "1.0.15",
            "evidence": "BMC AMI Common Configuration Plugin should be updated to version 1.0.15"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.0.14",
            "evidence": "BMC AMI Common Configuration Plugin up to and including 1.0.14"
          }
        ]
      },
      {
        "name": {
          "value": "NS-ND Integration Performance Publisher Plugin",
          "evidence": "NS-ND Integration Performance Publisher Plugin 4.8.0.130 requires POST requests and Overall/Administer permission for the affected form validation method."
        },
        "prerequisites": [
          {
            "value": "attackers with Overall/Read permission",
            "evidence": "This allows attackers with Overall/Read permission to connect to an attacker-specified webserver"
          },
          {
            "value": "attackers with Item/Configure permission",
            "evidence": "exploitable by attackers with Item/Configure permission."
          }
        ],
        "fixed_versions": [
          {
            "value": "4.8.0.130",
            "evidence": "NS-ND Integration Performance Publisher Plugin should be updated to version 4.8.0.130"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 4.8.0.129",
            "evidence": "NS-ND Integration Performance Publisher Plugin up to and including 4.8.0.129"
          },
          {
            "value": "up to and including 4.8.0.134",
            "evidence": "NS-ND Integration Performance Publisher Plugin up to and including 4.8.0.134"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2022-41224",
        "evidence": "SECURITY-2886 / CVE-2022-41224"
      },
      {
        "value": "CVE-2022-41225",
        "evidence": "SECURITY-2821 / CVE-2022-41225"
      },
      {
        "value": "CVE-2022-41226",
        "evidence": "SECURITY-2832 / CVE-2022-41226"
      },
      {
        "value": "CVE-2022-41227",
        "evidence": "CVE-2022-41227 (CSRF)"
      },
      {
        "value": "CVE-2022-41228",
        "evidence": "CVE-2022-41228 (missing permission check)"
      },
      {
        "value": "CVE-2022-41229",
        "evidence": "SECURITY-2858 / CVE-2022-41229"
      },
      {
        "value": "CVE-2022-41230",
        "evidence": "SECURITY-1994 / CVE-2022-41230"
      },
      {
        "value": "CVE-2022-41231",
        "evidence": "CVE-2022-41231 (path traversal)"
      },
      {
        "value": "CVE-2022-41232",
        "evidence": "CVE-2022-41232 (CSRF)"
      },
      {
        "value": "CVE-2022-41233",
        "evidence": "SECURITY-2170 / CVE-2022-41233"
      },
      {
        "value": "CVE-2022-41234",
        "evidence": "SECURITY-2169 / CVE-2022-41234"
      },
      {
        "value": "CVE-2022-41235",
        "evidence": "SECURITY-2645 / CVE-2022-41235"
      },
      {
        "value": "CVE-2022-41236",
        "evidence": "SECURITY-2051 / CVE-2022-41236"
      },
      {
        "value": "CVE-2022-41237",
        "evidence": "SECURITY-1737 / CVE-2022-41237"
      },
      {
        "value": "CVE-2022-41238",
        "evidence": "SECURITY-2867 / CVE-2022-41238"
      },
      {
        "value": "CVE-2022-41239",
        "evidence": "SECURITY-2884 / CVE-2022-41239"
      },
      {
        "value": "CVE-2022-41240",
        "evidence": "SECURITY-1870 / CVE-2022-41240"
      },
      {
        "value": "CVE-2022-41241",
        "evidence": "SECURITY-2805 / CVE-2022-41241"
      },
      {
        "value": "CVE-2022-41242",
        "evidence": "SECURITY-2001 / CVE-2022-41242"
      },
      {
        "value": "CVE-2022-41243",
        "evidence": "SECURITY-2068 / CVE-2022-41243"
      },
      {
        "value": "CVE-2022-41244",
        "evidence": "SECURITY-2069 / CVE-2022-41244"
      },
      {
        "value": "CVE-2022-41245",
        "evidence": "CVE-2022-41245 (CSRF)"
      },
      {
        "value": "CVE-2022-41246",
        "evidence": "CVE-2022-41246 (missing permission check)"
      },
      {
        "value": "CVE-2022-41247",
        "evidence": "CVE-2022-41247 (storage)"
      },
      {
        "value": "CVE-2022-41248",
        "evidence": "CVE-2022-41248 (masking)"
      },
      {
        "value": "CVE-2022-41249",
        "evidence": "CVE-2022-41249 (CSRF)"
      },
      {
        "value": "CVE-2022-41250",
        "evidence": "CVE-2022-41250 (missing permission check)"
      },
      {
        "value": "CVE-2022-41251",
        "evidence": "SECURITY-2710 / CVE-2022-41251"
      },
      {
        "value": "CVE-2022-41252",
        "evidence": "SECURITY-2752 / CVE-2022-41252"
      },
      {
        "value": "CVE-2022-41253",
        "evidence": "CVE-2022-41253 (CSRF)"
      },
      {
        "value": "CVE-2022-41254",
        "evidence": "CVE-2022-41254 (missing permission check)"
      },
      {
        "value": "CVE-2022-41255",
        "evidence": "SECURITY-2759 / CVE-2022-41255"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-jenkins-security-advisories",
  "document_id": 23945,
  "published_at": "2022-09-21T12:00:00+00:00"
}