Jenkins Security Advisory 2020-11-04

{
  "id": "705f227c520a2be046e7fbdb724e4d58255aa5896145ba5b61f84e88a601d5ee",
  "url": "https://www.jenkins.io/security/advisory/2020-11-04/",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Jenkins Security Advisory 2020-11-04",
    "summary": "The advisory describes vulnerabilities in Jenkins plugins, including authentication bypasses, XXE, permission-check issues, credential exposure, and XSS. It lists fixed versions for several plugins; no fixes were available for Static Analysis Utilities, FindBugs, Mail Commander, or VMware Lab Manager Slaves at publication.",
    "evidence": "Jenkins Security Advisory 2020-11-04",
    "products": [
      {
        "name": {
          "value": "Active Directory Plugin",
          "evidence": "Active Directory Plugin should be updated to version 2.20"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.20",
            "evidence": "Active Directory Plugin should be updated to version 2.20"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 2.19",
            "evidence": "Active Directory Plugin up to and including 2.19"
          }
        ]
      },
      {
        "name": {
          "value": "Static Analysis Utilities Plugin",
          "evidence": "Static Analysis Utilities Plugin up to and including 1.96"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 1.96",
            "evidence": "Static Analysis Utilities Plugin up to and including 1.96"
          }
        ]
      },
      {
        "name": {
          "value": "Ansible Plugin",
          "evidence": "Ansible Plugin should be updated to version 1.1"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.1",
            "evidence": "Ansible Plugin should be updated to version 1.1"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.0",
            "evidence": "Ansible Plugin up to and including 1.0"
          }
        ]
      },
      {
        "name": {
          "value": "AppSpider Plugin",
          "evidence": "AppSpider Plugin should be updated to version 1.0.13"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.0.13",
            "evidence": "AppSpider Plugin should be updated to version 1.0.13"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.0.12",
            "evidence": "AppSpider Plugin up to and including 1.0.12"
          }
        ]
      },
      {
        "name": {
          "value": "AWS Global Configuration Plugin",
          "evidence": "AWS Global Configuration Plugin should be updated to version 1.6"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.6",
            "evidence": "AWS Global Configuration Plugin should be updated to version 1.6"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.5",
            "evidence": "AWS Global Configuration Plugin up to and including 1.5"
          }
        ]
      },
      {
        "name": {
          "value": "Azure Key Vault Plugin",
          "evidence": "Azure Key Vault Plugin should be updated to version 2.1"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.1",
            "evidence": "Azure Key Vault Plugin should be updated to version 2.1"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 2.0",
            "evidence": "Azure Key Vault Plugin up to and including 2.0"
          }
        ]
      },
      {
        "name": {
          "value": "FindBugs Plugin",
          "evidence": "FindBugs Plugin up to and including 5.0.0"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 5.0.0",
            "evidence": "FindBugs Plugin up to and including 5.0.0"
          }
        ]
      },
      {
        "name": {
          "value": "Kubernetes Plugin",
          "evidence": "Kubernetes Plugin should be updated to version 1.27.4"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.27.4",
            "evidence": "Kubernetes Plugin should be updated to version 1.27.4"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.27.3",
            "evidence": "Kubernetes Plugin up to and including 1.27.3"
          }
        ]
      },
      {
        "name": {
          "value": "Mail Commander Plugin for Jenkins-ci Plugin",
          "evidence": "Mail Commander Plugin for Jenkins-ci Plugin up to and including 1.0.0"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 1.0.0",
            "evidence": "Mail Commander Plugin for Jenkins-ci Plugin up to and including 1.0.0"
          }
        ]
      },
      {
        "name": {
          "value": "Mercurial Plugin",
          "evidence": "Mercurial Plugin should be updated to version 2.12"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.12",
            "evidence": "Mercurial Plugin should be updated to version 2.12"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 2.11",
            "evidence": "Mercurial Plugin up to and including 2.11"
          }
        ]
      },
      {
        "name": {
          "value": "SQLPlus Script Runner Plugin",
          "evidence": "SQLPlus Script Runner Plugin should be updated to version 2.0.13"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.0.13",
            "evidence": "SQLPlus Script Runner Plugin should be updated to version 2.0.13"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 2.0.12",
            "evidence": "SQLPlus Script Runner Plugin up to and including 2.0.12"
          }
        ]
      },
      {
        "name": {
          "value": "Subversion Plugin",
          "evidence": "Subversion Plugin should be updated to version 2.13.2"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.13.2",
            "evidence": "Subversion Plugin should be updated to version 2.13.2"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 2.13.1",
            "evidence": "Subversion Plugin up to and including 2.13.1"
          }
        ]
      },
      {
        "name": {
          "value": "Visualworks Store Plugin",
          "evidence": "Visualworks Store Plugin should be updated to version 1.1.4"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.1.4",
            "evidence": "Visualworks Store Plugin should be updated to version 1.1.4"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.1.3",
            "evidence": "Visualworks Store Plugin up to and including 1.1.3"
          }
        ]
      },
      {
        "name": {
          "value": "VMware Lab Manager Slaves Plugin",
          "evidence": "VMware Lab Manager Slaves Plugin up to and including 0.2.8"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 0.2.8",
            "evidence": "VMware Lab Manager Slaves Plugin up to and including 0.2.8"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2020-2299",
        "evidence": "SECURITY-2117 / CVE-2020-2299"
      },
      {
        "value": "CVE-2020-2300",
        "evidence": "SECURITY-2099 / CVE-2020-2300"
      },
      {
        "value": "CVE-2020-2301",
        "evidence": "SECURITY-2123 / CVE-2020-2301"
      },
      {
        "value": "CVE-2020-2302",
        "evidence": "SECURITY-1999 / CVE-2020-2302"
      },
      {
        "value": "CVE-2020-2303",
        "evidence": "SECURITY-2126 / CVE-2020-2303"
      },
      {
        "value": "CVE-2020-2304",
        "evidence": "SECURITY-2145 / CVE-2020-2304"
      },
      {
        "value": "CVE-2020-2305",
        "evidence": "SECURITY-2115 / CVE-2020-2305"
      },
      {
        "value": "CVE-2020-2306",
        "evidence": "SECURITY-2104 / CVE-2020-2306"
      },
      {
        "value": "CVE-2020-2307",
        "evidence": "SECURITY-1646 / CVE-2020-2307"
      },
      {
        "value": "CVE-2020-2308",
        "evidence": "SECURITY-2102 / CVE-2020-2308"
      },
      {
        "value": "CVE-2020-2309",
        "evidence": "SECURITY-2103 / CVE-2020-2309"
      },
      {
        "value": "CVE-2020-2310",
        "evidence": "SECURITY-1943 / CVE-2020-2310"
      },
      {
        "value": "CVE-2020-2311",
        "evidence": "SECURITY-2101 / CVE-2020-2311"
      },
      {
        "value": "CVE-2020-2312",
        "evidence": "SECURITY-2129 / CVE-2020-2312"
      },
      {
        "value": "CVE-2020-2313",
        "evidence": "SECURITY-2110 / CVE-2020-2313"
      },
      {
        "value": "CVE-2020-2314",
        "evidence": "SECURITY-2058 / CVE-2020-2314"
      },
      {
        "value": "CVE-2020-2315",
        "evidence": "SECURITY-1900 / CVE-2020-2315"
      },
      {
        "value": "CVE-2020-2316",
        "evidence": "SECURITY-1907 / CVE-2020-2316"
      },
      {
        "value": "CVE-2020-2317",
        "evidence": "SECURITY-1918 / CVE-2020-2317"
      },
      {
        "value": "CVE-2020-2318",
        "evidence": "SECURITY-2085 / CVE-2020-2318"
      },
      {
        "value": "CVE-2020-2319",
        "evidence": "SECURITY-2084 / CVE-2020-2319"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-jenkins-security-advisories",
  "document_id": 23979,
  "published_at": "2020-11-04T12:00:00+00:00"
}