|dev-util/jenkins-bin: Multiple vulnerabilities
|Florian Schuhmacher <mynt1aa>
|Gentoo Security <security>
|glsamaker, graaff, moog621, patrick
|Runtime testing required:
Description Florian Schuhmacher 2018-07-18 15:14:18 UTC
SECURITY-897 Unauthenticated users could provide maliciously crafted login credentials that cause Jenkins to move the config.xml file from the Jenkins home directory. This configuration file contains basic configuration of Jenkins, including the selected security realm and authorization strategy. If Jenkins is started without this file present, it will revert to the legacy defaults of granting administrator access to anonymous users. SECURITY-914 An arbitrary file read vulnerability in the Stapler web framework used by Jenkins allowed unauthenticated users to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master process has access to. SECURITY-891 The URLs handling cancellation of queued builds did not perform a permission check, allowing users with Overall/Read permission to cancel queued builds. SECURITY-892 The URL that initiates agent launches on the Jenkins master did not perform a permission check, allowing users with Overall/Read permission to initiate agent launches. SECURITY-944 The build timeline widget shown on URLs like /view/…/builds did not properly escape display names of items. This resulted in a cross-site scripting vulnerability exploitable by users able to control item display names. SECURITY-925 Files indicating when a plugin JPI file was last extracted into a subdirectory of plugins/ in the Jenkins home directory was accessible via HTTP by users with Overall/Read permission. This allowed unauthorized users to determine the likely install date of a given plugin. SECURITY-390 Stapler is the web framework used by Jenkins to route HTTP requests. When its debug mode is enabled, HTTP 404 error pages display diagnostic information. Those error pages did not escape parts of URLs they displayed, in rare cases resulting in a cross-site scripting vulnerability. Gentoo Security Scout Florian Schuhmacher
Comment 1 Hans de Graaff 2018-07-18 18:41:30 UTC
jenkins-bin 2.121.2 (LTS) and jenkins-bin 2.133 have been added.
Comment 2 Hans de Graaff 2018-07-18 18:47:50 UTC
Vulnerable versions have been removed.
Comment 3 Hans de Graaff 2018-08-03 06:25:29 UTC
*** Bug 662628 has been marked as a duplicate of this bug. ***
Comment 4 Aaron Bauman (RETIRED) 2018-11-24 23:56:32 UTC
*** Bug 662442 has been marked as a duplicate of this bug. ***
Comment 5 Sam James 2020-03-26 19:09:26 UTC
Tree is clean.