Jenkins Security Advisory 2020-09-16

{
  "id": "dd01cd70a6cc265e085096dd68ee2e3070b62c866e0b92f8def38684a1a383aa",
  "url": "https://www.jenkins.io/security/advisory/2020-09-16/",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Jenkins Security Advisory 2020-09-16",
    "summary": "The Jenkins advisory reports vulnerabilities in multiple plugins. It provides fixed versions for Blue Ocean, Computer Queue, Email Extension, Health Advisor by CloudBees, Mailer, perfecto, Pipeline Maven Integration, and Validating String Parameter; several other plugins have no fix available as of publication.",
    "evidence": "Jenkins Security Advisory 2020-09-16",
    "products": [
      {
        "name": {
          "value": "Blue Ocean Plugin",
          "evidence": "Blue Ocean Plugin should be updated to version 1.23.3"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.23.3",
            "evidence": "Blue Ocean Plugin should be updated to version 1.23.3"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.23.2",
            "evidence": "Blue Ocean Plugin up to and including 1.23.2"
          }
        ]
      },
      {
        "name": {
          "value": "Computer Queue Plugin",
          "evidence": "Computer Queue Plugin should be updated to version 1.6"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.6",
            "evidence": "Computer Queue Plugin should be updated to version 1.6"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.5",
            "evidence": "Computer Queue Plugin up to and including 1.5"
          }
        ]
      },
      {
        "name": {
          "value": "Email Extension Plugin",
          "evidence": "Email Extension Plugin should be updated to version 2.76"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.76",
            "evidence": "Email Extension Plugin should be updated to version 2.76"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 2.75",
            "evidence": "Email Extension Plugin up to and including 2.75"
          }
        ]
      },
      {
        "name": {
          "value": "Health Advisor by CloudBees Plugin",
          "evidence": "Health Advisor by CloudBees Plugin should be updated to version 3.2.1"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "3.2.1",
            "evidence": "Health Advisor by CloudBees Plugin should be updated to version 3.2.1"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 3.2.0",
            "evidence": "Health Advisor by CloudBees Plugin up to and including 3.2.0"
          }
        ]
      },
      {
        "name": {
          "value": "Mailer Plugin",
          "evidence": "Mailer Plugin should be updated to version 1.32.1"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.32.1",
            "evidence": "Mailer Plugin should be updated to version 1.32.1"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.32",
            "evidence": "Mailer Plugin up to and including 1.32"
          }
        ]
      },
      {
        "name": {
          "value": "perfecto Plugin",
          "evidence": "perfecto Plugin should be updated to version 1.18"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.18",
            "evidence": "perfecto Plugin should be updated to version 1.18"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.17",
            "evidence": "perfecto Plugin up to and including 1.17"
          }
        ]
      },
      {
        "name": {
          "value": "Pipeline Maven Integration Plugin",
          "evidence": "Pipeline Maven Integration Plugin should be updated to version 3.9.3"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "3.9.3",
            "evidence": "Pipeline Maven Integration Plugin should be updated to version 3.9.3"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 3.9.2",
            "evidence": "Pipeline Maven Integration Plugin up to and including 3.9.2"
          }
        ]
      },
      {
        "name": {
          "value": "Validating String Parameter Plugin",
          "evidence": "Validating String Parameter Plugin should be updated to version 2.5"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.5",
            "evidence": "Validating String Parameter Plugin should be updated to version 2.5"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 2.4",
            "evidence": "Validating String Parameter Plugin up to and including 2.4"
          }
        ]
      },
      {
        "name": {
          "value": "android-lint Plugin",
          "evidence": "android-lint Plugin up to and including 2.6"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 2.6",
            "evidence": "android-lint Plugin up to and including 2.6"
          }
        ]
      },
      {
        "name": {
          "value": "chosen-views-tabbar Plugin",
          "evidence": "chosen-views-tabbar Plugin up to and including 1.2"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 1.2",
            "evidence": "chosen-views-tabbar Plugin up to and including 1.2"
          }
        ]
      },
      {
        "name": {
          "value": "ClearCase Release Plugin",
          "evidence": "ClearCase Release Plugin up to and including 0.3"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 0.3",
            "evidence": "ClearCase Release Plugin up to and including 0.3"
          }
        ]
      },
      {
        "name": {
          "value": "Copy data to workspace Plugin",
          "evidence": "Copy data to workspace Plugin up to and including 1.0"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 1.0",
            "evidence": "Copy data to workspace Plugin up to and including 1.0"
          }
        ]
      },
      {
        "name": {
          "value": "Coverage/Complexity Scatter Plot Plugin",
          "evidence": "Coverage/Complexity Scatter Plot Plugin up to and including 1.1.1"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 1.1.1",
            "evidence": "Coverage/Complexity Scatter Plot Plugin up to and including 1.1.1"
          }
        ]
      },
      {
        "name": {
          "value": "Custom Job Icon Plugin",
          "evidence": "Custom Job Icon Plugin up to and including 0.2"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 0.2",
            "evidence": "Custom Job Icon Plugin up to and including 0.2"
          }
        ]
      },
      {
        "name": {
          "value": "Description Column Plugin",
          "evidence": "Description Column Plugin up to and including 1.3"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 1.3",
            "evidence": "Description Column Plugin up to and including 1.3"
          }
        ]
      },
      {
        "name": {
          "value": "ElasTest Plugin",
          "evidence": "ElasTest Plugin up to and including 1.2.1"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 1.2.1",
            "evidence": "ElasTest Plugin up to and including 1.2.1"
          }
        ]
      },
      {
        "name": {
          "value": "Locked Files Report Plugin",
          "evidence": "Locked Files Report Plugin up to and including 1.6"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 1.6",
            "evidence": "Locked Files Report Plugin up to and including 1.6"
          }
        ]
      },
      {
        "name": {
          "value": "MongoDB Plugin",
          "evidence": "MongoDB Plugin up to and including 1.3"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 1.3",
            "evidence": "MongoDB Plugin up to and including 1.3"
          }
        ]
      },
      {
        "name": {
          "value": "Radiator View Plugin",
          "evidence": "Radiator View Plugin up to and including 1.29"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 1.29",
            "evidence": "Radiator View Plugin up to and including 1.29"
          }
        ]
      },
      {
        "name": {
          "value": "Selection tasks Plugin",
          "evidence": "Selection tasks Plugin up to and including 1.0"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 1.0",
            "evidence": "Selection tasks Plugin up to and including 1.0"
          }
        ]
      },
      {
        "name": {
          "value": "Storable Configs Plugin",
          "evidence": "Storable Configs Plugin up to and including 1.0"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 1.0",
            "evidence": "Storable Configs Plugin up to and including 1.0"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2020-2252",
        "evidence": "SECURITY-1813 / CVE-2020-2252"
      },
      {
        "value": "CVE-2020-2253",
        "evidence": "SECURITY-1851 / CVE-2020-2253"
      },
      {
        "value": "CVE-2020-2254",
        "evidence": "SECURITY-1956 / CVE-2020-2254"
      },
      {
        "value": "CVE-2020-2255",
        "evidence": "SECURITY-1961 / CVE-2020-2255"
      },
      {
        "value": "CVE-2020-2256",
        "evidence": "SECURITY-1976 / CVE-2020-2256"
      },
      {
        "value": "CVE-2020-2257",
        "evidence": "SECURITY-1935 / CVE-2020-2257"
      },
      {
        "value": "CVE-2020-2258",
        "evidence": "SECURITY-1998 / CVE-2020-2258"
      },
      {
        "value": "CVE-2020-2259",
        "evidence": "SECURITY-1912 / CVE-2020-2259"
      },
      {
        "value": "CVE-2020-2260",
        "evidence": "SECURITY-1979 / CVE-2020-2260"
      },
      {
        "value": "CVE-2020-2261",
        "evidence": "SECURITY-1980 / CVE-2020-2261"
      },
      {
        "value": "CVE-2020-2262",
        "evidence": "SECURITY-1908 / CVE-2020-2262"
      },
      {
        "value": "CVE-2020-2263",
        "evidence": "SECURITY-1927 / CVE-2020-2263"
      },
      {
        "value": "CVE-2020-2264",
        "evidence": "SECURITY-1914 / CVE-2020-2264"
      },
      {
        "value": "CVE-2020-2265",
        "evidence": "SECURITY-1913 / CVE-2020-2265"
      },
      {
        "value": "CVE-2020-2266",
        "evidence": "SECURITY-1916 / CVE-2020-2266"
      },
      {
        "value": "CVE-2020-2267",
        "evidence": "CVE-2020-2267 (missing permission check)"
      },
      {
        "value": "CVE-2020-2268",
        "evidence": "CVE-2020-2268 (CSRF)"
      },
      {
        "value": "CVE-2020-2269",
        "evidence": "SECURITY-1869 / CVE-2020-2269"
      },
      {
        "value": "CVE-2020-2270",
        "evidence": "SECURITY-1911 / CVE-2020-2270"
      },
      {
        "value": "CVE-2020-2271",
        "evidence": "SECURITY-1921 / CVE-2020-2271"
      },
      {
        "value": "CVE-2020-2272",
        "evidence": "CVE-2020-2272 (missing permission check)"
      },
      {
        "value": "CVE-2020-2273",
        "evidence": "CVE-2020-2273 (CSRF)"
      },
      {
        "value": "CVE-2020-2274",
        "evidence": "SECURITY-2014 / CVE-2020-2274"
      },
      {
        "value": "CVE-2020-2275",
        "evidence": "SECURITY-1966 / CVE-2020-2275"
      },
      {
        "value": "CVE-2020-2276",
        "evidence": "SECURITY-1967 / CVE-2020-2276"
      },
      {
        "value": "CVE-2020-2277",
        "evidence": "SECURITY-1968 (1) / CVE-2020-2277"
      },
      {
        "value": "CVE-2020-2278",
        "evidence": "SECURITY-1968 (2) / CVE-2020-2278"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-jenkins-security-advisories",
  "document_id": 23981,
  "published_at": "2020-09-16T12:00:00+00:00"
}