-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2022.3676
               Jenkins Plugins Security Advisory 2022-07-27
                               28 July 2022

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Jenkins Plugins
Publisher:         Jenkins
Operating System:  Windows
                   UNIX variants (UNIX, Linux, OSX)
Resolution:        Patch/Upgrade
CVE Names:         CVE-2022-36922 CVE-2022-36921 CVE-2022-36920
                   CVE-2022-36919 CVE-2022-36918 CVE-2022-36917
                   CVE-2022-36916 CVE-2022-36915 CVE-2022-36914
                   CVE-2022-36913 CVE-2022-36912 CVE-2022-36911
                   CVE-2022-36910 CVE-2022-36909 CVE-2022-36908
                   CVE-2022-36907 CVE-2022-36906 CVE-2022-36905
                   CVE-2022-36904 CVE-2022-36903 CVE-2022-36902
                   CVE-2022-36901 CVE-2022-36900 CVE-2022-36899
                   CVE-2022-36898 CVE-2022-36897 CVE-2022-36896
                   CVE-2022-36895 CVE-2022-36894 CVE-2022-36893
                   CVE-2022-36892 CVE-2022-36891 CVE-2022-36890
                   CVE-2022-36889 CVE-2022-36888 CVE-2022-36887
                   CVE-2022-36886 CVE-2022-36885 CVE-2022-36884
                   CVE-2022-36883 CVE-2022-36882 CVE-2022-36881

Original Bulletin: 
   https://www.jenkins.io/security/advisory/2022-07-27/

Comment: CVSS (Max):  8.8 CVE-2022-36922 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
         CVSS Source: Jenkins
         Calculator:  https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

- --------------------------BEGIN INCLUDED TEXT--------------------

Jenkins Security Advisory 2022-07-27  

This advisory announces vulnerabilities in the following Jenkins deliverables:

  o Android Signing Plugin
  o Buckminster Plugin
  o CLIF Performance Testing Plugin
  o Compuware ISPW Operations Plugin
  o Compuware Source Code Download for Endevor, PDS, and ISPW Plugin
  o Compuware Topaz Utilities Plugin
  o Compuware Xpediter Code Coverage Plugin
  o Compuware zAdviser API Plugin
  o Coverity Plugin
  o Deployer Framework Plugin
  o Dynamic Extended Choice Parameter Plugin
  o External Monitor Job Type Plugin
  o Files Found Trigger Plugin
  o Git Plugin
  o Git client Plugin
  o GitHub Plugin
  o Google Cloud Backup Plugin
  o HashiCorp Vault Plugin
  o HTTP Request Plugin
  o Job Configuration History Plugin
  o Lucene-Search Plugin
  o Maven Metadata Plugin for Jenkins CI server Plugin
  o OpenShift Deployer Plugin
  o Openstack Heat Plugin
  o Repository Connector Plugin
  o rhnpush-plugin Plugin
  o rpmsign-plugin Plugin

Descriptions  

Missing hostname verification in Git client Plugin  

SECURITY-1468 / CVE-2022-36881

Git client Plugin 3.11.0 and earlier does not perform SSH host key verification
when connecting to Git repositories via SSH.

This lack of verification could be abused using a man-in-the-middle attack to
intercept these connections.

Git client Plugin 3.11.1 provides strategies for performing host key
verification for administrators to select the one that meets their security
needs. For more information see the plugin documentation.

Lack of authentication mechanism in Git Plugin webhook  

SECURITY-284 / CVE-2022-36882 (CSRF), CVE-2022-36883 (permission check),
CVE-2022-36884 (information disclosure)

Git Plugin provides a webhook endpoint at /git/notifyCommit that can be used to
notify Jenkins of changes to an SCM repository. For its most basic
functionality, this endpoint receives a repository URL, and Jenkins will
schedule polling for all jobs configured with the specified repository. In Git
Plugin 4.11.3 and earlier, this endpoint can be accessed with GET requests and
without authentication.

In addition to this basic functionality, the endpoint also accept a sha1
parameter specifying a commit ID. If this parameter is specified, jobs
configured with the specified repo will be triggered immediately, and the build
will check out the specified commit.

Additionally, the output of the webhook endpoint will provide information about
which jobs were triggered or scheduled for polling, including jobs the user has
no permission to access.

This allows attackers with knowledge of Git repository URLs to trigger builds
of jobs using a specified Git repository and to cause them to check out an
attacker-specified commit, and to obtain information about the existence of
jobs configured with this Git repository.

Additionally, this webhook endpoint does not require POST requests, resulting
in a cross-site request forgery (CSRF) vulnerability.

Git Plugin 4.11.4 requires a token parameter which will act as an
authentication for the webhook endpoint. While GET requests remain allowed,
attackers would need to be able to provide a webhook token. For more
information see the plugin documentation.

Non-constant time webhook signature comparison in GitHub Plugin  

SECURITY-1849 / CVE-2022-36885

GitHub Plugin 1.34.4 and earlier does not use a constant-time comparison when
checking whether the provided and computed webhook signatures are equal.

This could potentially allow attackers to use statistical methods to obtain a
valid webhook signature.

GitHub Plugin 1.34.5 uses a constant-time comparison when validating the
webhook signature.

CSRF vulnerability in External Monitor Job Type Plugin  

SECURITY-2762 / CVE-2022-36886

External Monitor Job Type Plugin 191.v363d0d1efdf8 and earlier does not require
POST requests for an HTTP endpoint, resulting in a cross-site request forgery
(CSRF) vulnerability.

This vulnerability allows attackers to create runs of an external job.

External Monitor Job Type Plugin 192.ve979ca_8b_3ccd requires POST requests for
the affected HTTP endpoint.

CSRF vulnerability in Job Configuration History Plugin  

SECURITY-2766 / CVE-2022-36887

Job Configuration History Plugin 1155.v28a_46a_cc06a_5 and earlier does not
require POST requests for several HTTP endpoints, resulting in cross-site
request forgery (CSRF) vulnerabilities.

These vulnerabilities allow attackers to delete entries from job, agent, and
system configuration history, or restore older versions of job, agent, and
system configurations.

Job Configuration History Plugin 1156.v536a_97b_8d649 requires POST requests
for the affected HTTP endpoints.

Missing permission checks in HashiCorp Vault Plugin allow capturing credentials
 

SECURITY-2593 / CVE-2022-36888

HashiCorp Vault Plugin 354.vdb_858fd6b_f48 and earlier does not perform
permission checks in several HTTP endpoints performing Vault connection tests.

This allows attackers with Overall/Read permission to obtain credentials stored
in Vault with attacker-specified path and keys.

HashiCorp Vault Plugin 355.v3b_38d767a_b_a_8 requires Overall/Administer
permission to perform Vault connection tests.

Path traversal vulnerability in Deployer Framework Plugin allows reading
arbitrary files  

SECURITY-2764 / CVE-2022-36889

Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the
application path of the applications when configuring a deployment.

This allows attackers with Item/Configure permission to upload arbitrary files
from the Jenkins controller file system to the selected service.

Deployer Framework Plugin 86.v7b_a_4a_55b_f3ec ensures that only build
artifacts can be uploaded.

Path traversal vulnerability in Deployer Framework Plugin  

SECURITY-2206 / CVE-2022-36890

Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the
name of files in methods implementing form validation.

This allows attackers with Item/Read permission to check for the existence of
an attacker-specified file path on the Jenkins controller file system.

Deployer Framework Plugin 86.v7b_a_4a_55b_f3ec ensures that only files
contained inside the expected directory can be accessed.

Missing permission check in Deployer Framework Plugin allows reading deployment
logs  

SECURITY-2205 / CVE-2022-36891

Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not perform a
permission check in an HTTP endpoint.

This allows attackers with Item/Read permission to read deployment logs.

Deployer Framework Plugin 86.v7b_a_4a_55b_f3ec requires Deploy Now/Deploy
permission to read deployment logs.

Missing permission check in rhnpush-plugin Plugin allows listing workspace
contents  

SECURITY-2402 / CVE-2022-36892

rhnpush-plugin Plugin 0.5.1 and earlier does not perform a permission check in
a method implementing form validation.

This allows attackers with Item/Read permission but without Item/Workspace or
Item/Configure permission to check whether attacker-specified file patterns
match workspace contents. A sequence of requests can be used to effectively
list workspace contents.

rhnpush-plugin Plugin 0.5.2 requires Item/Workspace permission to validate
patterns with workspace contents.

Missing permission check in rpmsign-plugin Plugin allows listing workspace
contents  

SECURITY-2403 / CVE-2022-36893

rpmsign-plugin Plugin 0.5.0 and earlier does not perform a permission check in
a method implementing form validation.

This allows attackers with Item/Read permission but without Item/Workspace or
Item/Configure permission to check whether attacker-specified file patterns
match workspace contents. A sequence of requests can be used to effectively
list workspace contents.

rpmsign-plugin Plugin 0.5.1 requires Item/Workspace permission to validate
patterns with workspace contents.

Arbitrary file write vulnerability in CLIF Performance Testing Plugin  

SECURITY-2413 / CVE-2022-36894

CLIF Performance Testing Plugin 64.vc0d66de1dfb_f and earlier allows users to
extract files from an archive without validating file paths of files contained
within the archive.

This allows attackers with Overall/Read permission to create or replace
arbitrary files on the Jenkins controller file system with attacker-specified
content.

As of publication of this advisory, there is no fix. Learn why we announce
this.

Missing permission checks in Compuware Topaz Utilities Plugin  

SECURITY-2619 / CVE-2022-36895

Compuware Topaz Utilities Plugin 1.0.8 and earlier does not perform permission
checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate hosts and ports
of Compuware configurations and credentials IDs of credentials stored in
Jenkins. Those credentials IDs can be used as part of an attack to capture the
credentials using another vulnerability.

Compuware Topaz Utilities Plugin 1.0.9 requires the appropriate permissions to
enumerate hosts and ports of Compuware configurations and credentials IDs.

Missing permission checks in Compuware Source Code Download for Endevor, PDS,
and ISPW Plugin  

SECURITY-2621 / CVE-2022-36896

Compuware Source Code Download for Endevor, PDS, and ISPW Plugin 2.0.12 and
earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate hosts and ports
of Compuware configurations and credentials IDs of credentials stored in
Jenkins. Those credentials IDs can be used as part of an attack to capture the
credentials using another vulnerability.

Compuware Source Code Download for Endevor, PDS, and ISPW Plugin 2.0.13
requires the appropriate permissions to enumerate hosts and ports of Compuware
configurations and credentials IDs.

Missing permission checks in Compuware Xpediter Code Coverage Plugin  

SECURITY-2626 / CVE-2022-36897

Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier does not perform
permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate hosts and ports
of Compuware configurations and credentials IDs of credentials stored in
Jenkins. Those credentials IDs can be used as part of an attack to capture the
credentials using another vulnerability.

Compuware Xpediter Code Coverage Plugin 1.0.8 requires the appropriate
permissions to enumerate hosts and ports of Compuware configurations and
credentials IDs.

Missing permission checks in Compuware ISPW Operations Plugin  

SECURITY-2628 / CVE-2022-36898

Compuware ISPW Operations Plugin 1.0.8 and earlier does not perform permission
checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate hosts and ports
of Compuware configurations and credentials IDs of credentials stored in
Jenkins. Those credentials IDs can be used as part of an attack to capture the
credentials using another vulnerability.

Compuware ISPW Operations Plugin 1.0.9 requires the appropriate permissions to
enumerate hosts and ports of Compuware configurations and credentials IDs.

Agent-to-controller security bypass in Compuware ISPW Operations Plugin  

SECURITY-2629 / CVE-2022-36899

Compuware ISPW Operations Plugin defines a controller/agent message that
retrieves Java system properties.

Compuware ISPW Operations Plugin 1.0.8 and earlier does not restrict execution
of the controller/agent message to agents. This allows attackers able to
control agent processes to retrieve Java system properties.

 This vulnerability is only exploitable in Jenkins 2.318 and earlier, LTS
 2.303.2 and earlier. See the LTS upgrade guide.

Compuware ISPW Operations Plugin 1.0.9 does not allow the affected controller/
agent message to be submitted by agents for execution on the controller.

Agent-to-controller security bypass in Compuware zAdviser API Plugin  

SECURITY-2630 / CVE-2022-36900

Compuware zAdviser API Plugin defines a controller/agent message that retrieves
Java system properties.

Compuware zAdviser API Plugin 1.0.3 and earlier does not restrict execution of
the controller/agent message to agents. This allows attackers able to control
agent processes to retrieve Java system properties.

 This vulnerability is only exploitable in Jenkins 2.318 and earlier, LTS
 2.303.2 and earlier. See the LTS upgrade guide.

Compuware zAdviser API Plugin 1.0.4 does not allow the affected controller/
agent message to be submitted by agents for execution on the controller.

Passwords stored in plain text by HTTP Request Plugin  

SECURITY-2053 / CVE-2022-36901

HTTP Request Plugin 1.15 and earlier stores HTTP Request passwords unencrypted
in its global configuration file jenkins.plugins.http_request.HttpRequest.xml
on the Jenkins controller as part of its configuration when using (deprecated)
Basic/Digest Authentication.

These passwords can be viewed by users with access to the Jenkins controller
file system.

As of publication of this advisory, there is no fix. Learn why we announce
this.

Stored XSS vulnerability in Dynamic Extended Choice Parameter Plugin  

SECURITY-2682 / CVE-2022-36902

Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape
several fields of Moded Extended Choice parameters.

This results in a stored cross-site scripting (XSS) vulnerability exploitable
by attackers with Item/Configure permission.

As of publication of this advisory, there is no fix. Learn why we announce
this.

Missing permission checks in Repository Connector Plugin allow enumerating
credentials IDs  

SECURITY-2665 (1) / CVE-2022-36903

Repository Connector Plugin 2.2.0 and earlier does not perform permission
checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate credentials IDs
of credentials stored in Jenkins. Those can be used as part of an attack to
capture the credentials using another vulnerability.

As of publication of this advisory, there is no fix. Learn why we announce
this.

Missing permission check in Repository Connector Plugin allows listing the
Jenkins controller file system  

SECURITY-2665 (2) / CVE-2022-36904

Repository Connector Plugin 2.2.0 and earlier does not perform a permission
check in a method implementing form validation.

This allows attackers with Overall/Read permission to check for the existence
of an attacker-specified file path on the Jenkins controller file system. A
sequence of requests can be used to effectively list the Jenkins controller
file system.

As of publication of this advisory, there is no fix. Learn why we announce
this.

Stored XSS vulnerability in Maven Metadata Plugin for Jenkins CI server Plugin 
 

SECURITY-2686 / CVE-2022-36905

Maven Metadata Plugin for Jenkins CI server Plugin 2.2 and earlier does not
perform URL validation for the Repository Base URL of List maven artifact
versions parameters.

This results in a stored cross-site scripting (XSS) vulnerability exploitable
by attackers with Item/Configure permission.

As of publication of this advisory, there is no fix. Learn why we announce
this.

CSRF vulnerability and missing permission check in OpenShift Deployer Plugin  

SECURITY-1375 (1) / CVE-2022-36906 (CSRF), CVE-2022-36907 (missing permission
check)

OpenShift Deployer Plugin 1.2.0 and earlier does not perform a permission check
in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an
attacker-specified URL using attacker-specified username and password.

Additionally, this form validation method does not require POST requests,
resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix. Learn why we announce
this.

CSRF vulnerability and missing permission check in OpenShift Deployer Plugin  

SECURITY-1375 (2) / CVE-2022-36908 (CSRF), CVE-2022-36909 (missing permission
check)

OpenShift Deployer Plugin 1.2.0 and earlier does not perform permission checks
in methods implementing form validation.

This allows attackers with Overall/Read permission to check for the existence
of an attacker-specified file path on the Jenkins controller file system and to
upload a SSH key file from the Jenkins controller file system to an
attacker-specified URL.

Additionally, these form validation methods do not require POST requests,
resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix. Learn why we announce
this.

Missing permission checks in Lucene-Search Plugin  

SECURITY-2048 / CVE-2022-36910

Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not perform permission
checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to reindex the database and
to obtain information about jobs otherwise inaccessible to them.

As of publication of this advisory, there is no fix. Learn why we announce
this.

CSRF vulnerability and missing permission checks in Openstack Heat Plugin  

SECURITY-2105 (1) / CVE-2022-36911 (CSRF), CVE-2022-36912 (missing permission
check)

Openstack Heat Plugin 1.5 and earlier does not perform permission checks in
methods implementing form validation.

This allows attackers with Overall/Read permission to connect to an
attacker-specified URL.

Additionally, these form validation methods do not require POST requests,
resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix. Learn why we announce
this.

Missing permission checks in Openstack Heat Plugin allow listing the Jenkins
controller file system  

SECURITY-2105 (2) / CVE-2022-36913

Openstack Heat Plugin 1.5 and earlier does not perform permission checks in
methods implementing form validation.

This allows attackers with Overall/Read permission to check for the existence
of an attacker-specified file path on the Jenkins controller file system. A
sequence of requests can be used to effectively list the Jenkins controller
file system.

As of publication of this advisory, there is no fix. Learn why we announce
this.

Missing permission check in Files Found Trigger Plugin allows listing the
Jenkins controller file system  

SECURITY-2210 / CVE-2022-36914

Files Found Trigger Plugin 1.5 and earlier does not perform a permission check
in a method implementing form validation.

This allows attackers with Overall/Read permission to check for the existence
of an attacker-specified file path on the Jenkins controller file system. A
sequence of requests can be used to effectively list the Jenkins controller
file system.

As of publication of this advisory, there is no fix. Learn why we announce
this.

Missing permission check in Android Signing Plugin allows listing workspace
contents  

SECURITY-2404 / CVE-2022-36915

Android Signing Plugin 2.2.5 and earlier does not perform a permission check in
a method implementing form validation.

This allows attackers with Item/Read permission but without Item/Workspace or
Item/Configure permission to check whether attacker-specified file patterns
match workspace contents. A sequence of requests can be used to effectively
list workspace contents.

As of publication of this advisory, there is no fix. Learn why we announce
this.

CSRF vulnerability and missing permission check in Google Cloud Backup Plugin  

SECURITY-2656 / CVE-2022-36916 (CSRF), CVE-2022-36917 (missing permission
check)

Google Cloud Backup Plugin 0.6 and earlier does not perform a permission check
in an HTTP endpoint.

This allows attackers with Overall/Read permission to request a manual backup.

Additionally, this HTTP endpoint does not require POST requests, resulting in a
cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix. Learn why we announce
this.

Missing permission check in Buckminster Plugin  

SECURITY-2747 / CVE-2022-36918

Buckminster Plugin 1.1.1 and earlier does not perform a permission check in a
method implementing form validation.

This allows attackers with Overall/Read permission to check for the existence
of an attacker-specified file path on the Jenkins controller file system. A
sequence of requests can be used to effectively list the Jenkins controller
file system.

As of publication of this advisory, there is no fix. Learn why we announce
this.

Missing permission check in Coverity Plugin allows enumerating credentials IDs 
 

SECURITY-2790 (1) / CVE-2022-36919

Coverity Plugin 1.11.4 and earlier does not perform a permission check in an
HTTP endpoint.

This allows attackers with Overall/Read permission to enumerate credentials IDs
of credentials stored in Jenkins. Those can be used as part of an attack to
capture the credentials using another vulnerability.

As of publication of this advisory, there is no fix. Learn why we announce
this.

CSRF vulnerability and missing permission check in Coverity Plugin allow
capturing credentials  

SECURITY-2790 (2) / CVE-2022-36920 (CSRF), CVE-2022-36921 (permission check)

Coverity Plugin 1.11.4 and earlier does not perform a permission check in an
HTTP endpoint.

This allows attackers with Overall/Read permission to connect to an
attacker-specified URL using attacker-specified credentials IDs obtained
through another method, capturing credentials stored in Jenkins.

Additionally, this HTTP endpoint does not require POST requests, resulting in a
cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix. Learn why we announce
this.

Reflected XSS vulnerability in Lucene-Search Plugin  

SECURITY-2812 / CVE-2022-36922

Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not escape the search
query parameter displayed on the search result page.

This results in a reflected cross-site scripting (XSS) vulnerability.

As of publication of this advisory, there is no fix. Learn why we announce
this.

Severity  

  o SECURITY-284: Medium
  o SECURITY-1375 (1): Medium
  o SECURITY-1375 (2): Medium
  o SECURITY-1468: Medium
  o SECURITY-1849: Low
  o SECURITY-2048: Medium
  o SECURITY-2053: Low
  o SECURITY-2105 (1): Medium
  o SECURITY-2105 (2): Medium
  o SECURITY-2205: Medium
  o SECURITY-2206: Medium
  o SECURITY-2210: Medium
  o SECURITY-2402: Medium
  o SECURITY-2403: Medium
  o SECURITY-2404: Medium
  o SECURITY-2413: High
  o SECURITY-2593: Medium
  o SECURITY-2619: Medium
  o SECURITY-2621: Medium
  o SECURITY-2626: Medium
  o SECURITY-2628: Medium
  o SECURITY-2629: Medium
  o SECURITY-2630: Medium
  o SECURITY-2656: Medium
  o SECURITY-2665 (1): Medium
  o SECURITY-2665 (2): Medium
  o SECURITY-2682: High
  o SECURITY-2686: High
  o SECURITY-2747: Medium
  o SECURITY-2762: Medium
  o SECURITY-2764: Medium
  o SECURITY-2766: Medium
  o SECURITY-2790 (1): Medium
  o SECURITY-2790 (2): High
  o SECURITY-2812: High

Affected Versions  

  o Android Signing Plugin up to and including 2.2.5
  o Buckminster Plugin up to and including 1.1.1
  o CLIF Performance Testing Plugin up to and including 64.vc0d66de1dfb_f
  o Compuware ISPW Operations Plugin up to and including 1.0.8
  o Compuware Source Code Download for Endevor, PDS, and ISPW Plugin up to and
    including 2.0.12
  o Compuware Topaz Utilities Plugin up to and including 1.0.8
  o Compuware Xpediter Code Coverage Plugin up to and including 1.0.7
  o Compuware zAdviser API Plugin up to and including 1.0.3
  o Coverity Plugin up to and including 1.11.4
  o Deployer Framework Plugin up to and including 85.v1d1888e8c021
  o Dynamic Extended Choice Parameter Plugin up to and including 1.0.1
  o External Monitor Job Type Plugin up to and including 191.v363d0d1efdf8
  o Files Found Trigger Plugin up to and including 1.5
  o Git Plugin up to and including 4.11.3
  o Git client Plugin up to and including 3.11.0
  o GitHub Plugin up to and including 1.34.4
  o Google Cloud Backup Plugin up to and including 0.6
  o HashiCorp Vault Plugin up to and including 354.vdb_858fd6b_f48
  o HTTP Request Plugin up to and including 1.15
  o Job Configuration History Plugin up to and including 1155.v28a_46a_cc06a_5
  o Lucene-Search Plugin up to and including 370.v62a5f618cd3a
  o Maven Metadata Plugin for Jenkins CI server Plugin up to and including 2.2
  o OpenShift Deployer Plugin up to and including 1.2.0
  o Openstack Heat Plugin up to and including 1.5
  o Repository Connector Plugin up to and including 2.2.0
  o rhnpush-plugin Plugin up to and including 0.5.1
  o rpmsign-plugin Plugin up to and including 0.5.0

Fix  

  o Compuware ISPW Operations Plugin should be updated to version 1.0.9
  o Compuware Source Code Download for Endevor, PDS, and ISPW Plugin should be
    updated to version 2.0.13
  o Compuware Topaz Utilities Plugin should be updated to version 1.0.9
  o Compuware Xpediter Code Coverage Plugin should be updated to version 1.0.8
  o Compuware zAdviser API Plugin should be updated to version 1.0.4
  o Deployer Framework Plugin should be updated to version 86.v7b_a_4a_55b_f3ec
  o External Monitor Job Type Plugin should be updated to version
    192.ve979ca_8b_3ccd
  o Git Plugin should be updated to version 4.11.4
  o Git client Plugin should be updated to version 3.11.1
  o GitHub Plugin should be updated to version 1.34.5
  o HashiCorp Vault Plugin should be updated to version 355.v3b_38d767a_b_a_8
  o Job Configuration History Plugin should be updated to version
    1156.v536a_97b_8d649
  o rhnpush-plugin Plugin should be updated to version 0.5.2
  o rpmsign-plugin Plugin should be updated to version 0.5.1

These versions include fixes to the vulnerabilities described above. All prior
versions are considered to be affected by these vulnerabilities unless
otherwise indicated.

As of publication of this advisory, no fixes are available for the following
plugins:

  o Android Signing Plugin
  o Buckminster Plugin
  o CLIF Performance Testing Plugin
  o Coverity Plugin
  o Dynamic Extended Choice Parameter Plugin
  o Files Found Trigger Plugin
  o Google Cloud Backup Plugin
  o HTTP Request Plugin
  o Lucene-Search Plugin
  o Maven Metadata Plugin for Jenkins CI server Plugin
  o OpenShift Deployer Plugin
  o Openstack Heat Plugin
  o Repository Connector Plugin

Learn why we announce these issues.

Credit  

The Jenkins project would like to thank the reporters for discovering and
reporting these vulnerabilities:

  o Daniel Beck, CloudBees, Inc. for SECURITY-284, SECURITY-1375 (1),
    SECURITY-1375 (2), SECURITY-2105 (1), SECURITY-2105 (2), SECURITY-2205,
    SECURITY-2206, SECURITY-2402, SECURITY-2403, SECURITY-2404, SECURITY-2764
  o James Nord, CloudBees, Inc., and, independently, Alex Kurtser, Satori Cyber
    Ltd. for SECURITY-1468
  o Jeff Thompson, CloudBees, Inc. for SECURITY-2048
  o Jesse Glick, CloudBees, Inc. for SECURITY-1849
  o Kevin Guerroudj, CloudBees, Inc. for SECURITY-2593, SECURITY-2656,
    SECURITY-2665 (1), SECURITY-2665 (2), SECURITY-2682, SECURITY-2686
  o Long Nguyen, Viettel Cyber Security for SECURITY-2053
  o Valdes Che Zogou, CloudBees, Inc. for SECURITY-2747, SECURITY-2766,
    SECURITY-2790 (1), SECURITY-2790 (2), SECURITY-2812
  o Wadeck Follonier, CloudBees, Inc. for SECURITY-2210
  o Yaroslav Afenkin, CloudBees, Inc. for SECURITY-2762

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: https://auscert.org.au/gpg-key/

iQIVAwUBYuHAq8kNZI30y1K9AQgMahAApa1ToGSt80QWFRYF1EwetN9mHOFtj2te
/GP8WEtne4wUoNkJXSEBwPHTirZYy1I4wFQKwW85uYGcxRZVc2/NCaEpTGoraipJ
KSWHJKjk2EDqku0EWlEh2KNRTI0AbYpk0mwrWpGxWNV9oqAc5Vlay/TIuX7MPdCQ
tKi5WQAQi7sPcAdBpKGp5KaA8rQzTY27qkesWnVDyNe6TdeLgWeYH8zSPtSCWFvA
eslA8v0YW6rHJDcAbSNwe4MmrcaGvkK2FBGLH6ey3x+bexcoWJKI47ocac3UjADy
JKyLsAijnOH/W1gxuWauDGa0PGMEq2T7iaNti1rl3yp2vdITvcdkkgweKqpbFJ6m
hLsfdeljlp/Ti4wDlgmPQ40sNq+OADz5ZkDh+QuAsOfzoYj256rikcrQaPNFriG3
txFyVn/4szPy1umjebwknnXZlZvLw5H7dB3IOKTS1M9Tlcpv9n/QEzRcrqpOPz13
Xrrp6p5GwBfXvA8Wss6O/H/M+6GJfy5eOnpFL6dD4sQNlaXlvE7D8mOlY4e5FNW1
5F5s4uBUUZEQYg6NixlUcYKM8FNrdyoqXv8lXOm6dHcJk0JJ3QhTjJeDdmv3vMj1
Ach7MFKZEfYXzz+RUW9L3vvp697dEe64oYRLxQfkq/Vpe/6dw6fe3oHnlyieX2Ts
9+BgwWOf23w=
=lYDU
-----END PGP SIGNATURE-----