Jenkins Security Advisory 2020-09-23

{
  "id": "efc07a6dbc4cf4e6ddd86d5d15e1dbe0b9409acc84e7dcddf7c44035ea78c929",
  "url": "https://www.jenkins.io/security/advisory/2020-09-23/",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Jenkins Security Advisory 2020-09-23",
    "summary": "The advisory reports vulnerabilities in six Jenkins plugins and provides fixed versions. The issues include sandbox bypass, CSRF, missing permission checks, and stored XSS and XXE vulnerabilities.",
    "evidence": "This advisory announces vulnerabilities in the following Jenkins deliverables:",
    "products": [
      {
        "name": {
          "value": "Implied Labels Plugin",
          "evidence": "Implied Labels Plugin should be updated to version 0.7"
        },
        "prerequisites": [
          {
            "value": "Overall/Read permission",
            "evidence": "This allows attackers with Overall/Read permission to configure the plugin."
          }
        ],
        "fixed_versions": [
          {
            "value": "0.7",
            "evidence": "Implied Labels Plugin should be updated to version 0.7"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 0.6",
            "evidence": "Implied Labels Plugin up to and including 0.6"
          }
        ]
      },
      {
        "name": {
          "value": "Liquibase Runner Plugin",
          "evidence": "Liquibase Runner Plugin should be updated to version 1.4.8"
        },
        "prerequisites": [
          {
            "value": "attackers able to provide Liquibase changesets evaluated by the plugin",
            "evidence": "This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide Liquibase changesets evaluated by the plugin."
          },
          {
            "value": "Overall/Read permission",
            "evidence": "This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins."
          }
        ],
        "fixed_versions": [
          {
            "value": "1.4.7",
            "evidence": "Liquibase Runner Plugin should be updated to version 1.4.7"
          },
          {
            "value": "1.4.8",
            "evidence": "Liquibase Runner Plugin should be updated to version 1.4.8"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.4.5",
            "evidence": "Liquibase Runner Plugin up to and including 1.4.5"
          },
          {
            "value": "up to and including 1.4.7",
            "evidence": "Liquibase Runner Plugin up to and including 1.4.7"
          }
        ]
      },
      {
        "name": {
          "value": "Lockable Resources Plugin",
          "evidence": "Lockable Resources Plugin should be updated to version 2.9"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.9",
            "evidence": "Lockable Resources Plugin should be updated to version 2.9"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 2.8",
            "evidence": "Lockable Resources Plugin up to and including 2.8"
          }
        ]
      },
      {
        "name": {
          "value": "Script Security Plugin",
          "evidence": "Script Security Plugin should be updated to version 1.75"
        },
        "prerequisites": [
          {
            "value": "permission to define and run sandboxed scripts, including Pipelines",
            "evidence": "This vulnerability allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM."
          }
        ],
        "fixed_versions": [
          {
            "value": "1.75",
            "evidence": "Script Security Plugin should be updated to version 1.75"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.74",
            "evidence": "Script Security Plugin up to and including 1.74"
          }
        ]
      },
      {
        "name": {
          "value": "warnings Plugin",
          "evidence": "warnings Plugin should be updated to version 5.0.2"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "5.0.2",
            "evidence": "warnings Plugin should be updated to version 5.0.2"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 5.0.1",
            "evidence": "warnings Plugin up to and including 5.0.1"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2020-2279",
        "evidence": "SECURITY-2020 / CVE-2020-2279"
      },
      {
        "value": "CVE-2020-2280",
        "evidence": "SECURITY-2042 / CVE-2020-2280"
      },
      {
        "value": "CVE-2020-2281",
        "evidence": "SECURITY-1958 / CVE-2020-2281"
      },
      {
        "value": "CVE-2020-2282",
        "evidence": "SECURITY-2004 / CVE-2020-2282"
      },
      {
        "value": "CVE-2020-2283",
        "evidence": "SECURITY-1885 / CVE-2020-2283"
      },
      {
        "value": "CVE-2020-2284",
        "evidence": "SECURITY-1887 / CVE-2020-2284"
      },
      {
        "value": "CVE-2020-2285",
        "evidence": "SECURITY-2030 / CVE-2020-2285"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-jenkins-security-advisories",
  "document_id": 23983,
  "published_at": "2020-09-23T12:00:00+00:00"
}