Jenkins Security Advisory 2020-06-03

{
  "id": "c488cd81f36c5ec4a35cc7a5d7456c68b088fc34f92701b57fa1126dd34ae1a9",
  "url": "https://www.jenkins.io/security/advisory/2020-06-03/",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Jenkins Security Advisory 2020-06-03",
    "summary": "The advisory reports vulnerabilities in several Jenkins plugins. Fixes are available for Compact Columns, ECharts API, Script Security, and Swarm; the advisory says no fixes were available for Play Framework, Project Inheritance, Selenium, and Subversion Partial Release Manager at publication.",
    "evidence": "These versions include fixes to the vulnerabilities described above.",
    "products": [
      {
        "name": {
          "value": "Compact Columns Plugin",
          "evidence": "Compact Columns Plugin should be updated to version 1.12"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.12",
            "evidence": "Compact Columns Plugin should be updated to version 1.12"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.11",
            "evidence": "Compact Columns Plugin up to and including 1.11"
          }
        ]
      },
      {
        "name": {
          "value": "ECharts API Plugin",
          "evidence": "ECharts API Plugin should be updated to version 4.7.0-4"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "4.7.0-4",
            "evidence": "ECharts API Plugin should be updated to version 4.7.0-4"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 4.7.0-3",
            "evidence": "ECharts API Plugin up to and including 4.7.0-3"
          }
        ]
      },
      {
        "name": {
          "value": "Play Framework Plugin",
          "evidence": "Play Framework Plugin up to and including 1.0.2"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 1.0.2",
            "evidence": "Play Framework Plugin up to and including 1.0.2"
          }
        ]
      },
      {
        "name": {
          "value": "Project Inheritance Plugin",
          "evidence": "Project Inheritance Plugin up to and including 19.08.02"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 19.08.02",
            "evidence": "Project Inheritance Plugin up to and including 19.08.02"
          }
        ]
      },
      {
        "name": {
          "value": "Script Security Plugin",
          "evidence": "Script Security Plugin should be updated to version 1.73"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.73",
            "evidence": "Script Security Plugin should be updated to version 1.73"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.72",
            "evidence": "Script Security Plugin up to and including 1.72"
          }
        ]
      },
      {
        "name": {
          "value": "Selenium Plugin",
          "evidence": "Selenium Plugin up to and including 3.141.59"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 3.141.59",
            "evidence": "Selenium Plugin up to and including 3.141.59"
          }
        ]
      },
      {
        "name": {
          "value": "Subversion Partial Release Manager Plugin",
          "evidence": "Subversion Partial Release Manager Plugin up to and including 1.0.1"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 1.0.1",
            "evidence": "Subversion Partial Release Manager Plugin up to and including 1.0.1"
          }
        ]
      },
      {
        "name": {
          "value": "Swarm Plugin",
          "evidence": "Swarm Plugin should be updated to version 3.21"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "3.21",
            "evidence": "Swarm Plugin should be updated to version 3.21"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 3.20",
            "evidence": "Swarm Plugin up to and including 3.20"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2020-2190",
        "evidence": "SECURITY-1866 / CVE-2020-2190"
      },
      {
        "value": "CVE-2020-2191",
        "evidence": "CVE-2020-2191 (permission checks)"
      },
      {
        "value": "CVE-2020-2192",
        "evidence": "CVE-2020-2192 (CSRF)"
      },
      {
        "value": "CVE-2020-2193",
        "evidence": "SECURITY-1841 / CVE-2020-2193"
      },
      {
        "value": "CVE-2020-2194",
        "evidence": "SECURITY-1842 / CVE-2020-2194"
      },
      {
        "value": "CVE-2020-2195",
        "evidence": "SECURITY-1837 / CVE-2020-2195"
      },
      {
        "value": "CVE-2020-2196",
        "evidence": "SECURITY-1766 / CVE-2020-2196"
      },
      {
        "value": "CVE-2020-2197",
        "evidence": "CVE-2020-2197 (permission check)"
      },
      {
        "value": "CVE-2020-2198",
        "evidence": "CVE-2020-2198 (unredacted encrypted secrets)"
      },
      {
        "value": "CVE-2020-2199",
        "evidence": "SECURITY-1726 / CVE-2020-2199"
      },
      {
        "value": "CVE-2020-2200",
        "evidence": "SECURITY-1879 / CVE-2020-2200"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-jenkins-security-advisories",
  "document_id": 23988,
  "published_at": "2020-06-03T12:00:00+00:00"
}