Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2017.3119 Jenkins Security Advisory 2017-12-05 6 December 2017 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Jenkins Publisher: Jenkins Operating System: UNIX variants (UNIX, Linux, OSX) Windows Impact/Access: Cross-site Scripting -- Existing Account Resolution: Mitigation Original Bulletin: https://jenkins.io/security/advisory/2017-12-05/ - --------------------------BEGIN INCLUDED TEXT-------------------- Jenkins Security Advisory 2017-12-05 This advisory announces a vulnerability in Jenkins (weekly and LTS) and various plugins. Description Stored XSS vulnerability in tool names exploitable by administrators SECURITY-624 Jenkins administrators can configure tools, such as JDK, Maven, or Ant, that will be available in job configurations for use by build scripts. Some tool names are not properly escaped on job configuration forms, resulting in a stored cross-site scripting vulnerability. Tools confirmed to be affected are: JDK (provided by Jenkins core) Ant (provided by Ant plugin) Others may also be affected by this. This vulnerability can only be exploited by Jenkins administrators, as theyre the only ones able to define tools. In regular Jenkins configurations, administrators are able to run any code and install any plugin. Therefore this vulnerability only really affects installations that dont grant administrators the Run Scripts, Configure Update Sites, and/or Install Plugins permissions. As of publication of this advisory, there is no fix. The Jenkins project has prepared a plugin preventing the configuration of unsafe tool names at https://github.com/jenkinsci-cert/security624. If youre affected by this issue (i.e. are operating an instance restricting the permissions of administrators) we recommend installing the above plugin. You will need to build this plugin yourself. We are not planning to distribute it on our update sites, as we are unaware of any open source plugins enabling a configuration that would be affected by this vulnerability. Severity SECURITY-624: medium Affected versions All versions of Jenkins Fix As of publication of this advisory, there is no fix available other than the workaround provided above. Credit The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities: Dhiraj Datar, Lakhshya Cyber Security Labs for SECURITY-624 - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBWidSb4x+lLeg9Ub1AQgkyA/9EeSMQhdtXsTdUo4PKFFuUrR/DHL8znYn iEZOrh37qe/bcfqEx0qCyv6mKal5UyyL214al7OmzQa3zTQs75DrMSKAliw5fTu5 VL1gvyJO4w6bqeFsMfhpQlHhhPkdiO4rZezMYaeNbzThqpIpLeH5BLhyzGqw2UU+ i7V60Ga/upO3//naPOhNcDi9/gOi4eA2lEgA/rBeLkcK32bTyNkUJ1b2GlC6UAYa GxEHHZZTWFnPIFH7LII1WI+pkv4lDHo3CFEPfKIIauXH9N3QVgWgmOzXJuEyz03U a+FJv+JfR+1IpexcHdLUSk/URBIOZqKSFL7n6MOpU+EEnbZvjpsg+k4yqvykUY5O 0WG4YetPxk5r8mGhIeSUTHzw7iFggP+1v3km6tPiOQkN87xLS5+6x72Qtv4dt3mb O7Uzy3jYmEkprVBbmnNN3gsaz3yld3TA21oytE9LUtI+mZuLk+fl7ELqixbq2AXY YzSRva9DrTNtfE++hDK4C5oLI1M89WizU0LhRlcBGNUlI71kkbEb1BIRO6XDrAlL dF0kEoc3Rq6wC4mxIgWZrTgXjDwJAizkgzqzcHkCPzgdePkN8fAiHeljxWhYfLyK UTrv5RuJ98VCPNnhtoHNFHoAePMpb6Jme1wZgAGW4Z1HbPv2zM0fr8GQOrF5QRpp ZGln3/LxNu8= =Ypg7 -----END PGP SIGNATURE-----