Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2019.4420 Jenkins Security Advisory 2019-11-21 22 November 2019 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Jenkins plugins Publisher: Jenkins Operating System: UNIX variants (UNIX, Linux, OSX) Windows Impact/Access: Execute Arbitrary Code/Commands -- Existing Account Delete Arbitrary Files -- Existing Account Cross-site Scripting -- Remote with User Interaction Access Confidential Data -- Existing Account Unauthorised Access -- Existing Account Resolution: Patch/Upgrade CVE Names: CVE-2019-16548 CVE-2019-16547 CVE-2019-16546 CVE-2019-16545 CVE-2019-16544 CVE-2019-16543 CVE-2019-16542 CVE-2019-16541 CVE-2019-16540 CVE-2019-16539 CVE-2019-16538 Original Bulletin: https://jenkins.io/security/advisory/2019-11-21/ - --------------------------BEGIN INCLUDED TEXT-------------------- Jenkins Security Advisory 2019-11-21 This advisory announces vulnerabilities in the following Jenkins deliverables: o Anchore Container Image Scanner Plugin o Google Compute Engine Plugin o JIRA Plugin o QMetry for JIRA - Test Management Plugin o Script Security Plugin o Spira Importer Plugin o Support Core Plugin Descriptions Sandbox bypass vulnerability in Script Security Plugin SECURITY-1658 / CVE-2019-16538 Sandbox protection in Script Security Plugin could be circumvented through closure default parameter expressions. This allowed attackers able to specify and run sandboxed scripts to execute arbitrary code in the context of the Jenkins master JVM. These expressions are now subject to sandbox protection. Support Core Plugin allowed users with Overall/Read permission to delete arbitrary files SECURITY-1634 / CVE-2019-16539 (permission check), CVE-2019-16540 (path traversal) Support Core Plugin did not validate the paths submitted for the "Delete Support Bundles" feature. This allowed users to delete arbitrary files on the Jenkins master file system accessible to the OS user account running Jenkins. Additionally, this endpoint did not perform a permission check, allowing users with Overall/Read permission to delete support bundles, and any arbitrary other file, with a known name/path. Support Core Plugin now only allows the deletion of support bundles and related files listed on the UI through this feature. It also ensures that only users with "Download Bundle" permission are able to delete support bundles. Folder-scoped Jira sites in JIRA Plugin were able to access System-scoped credentials SECURITY-1106 / CVE-2019-16541 JIRA Plugin allows the definition of per-folder Jira sites. The credentials lookup for this feature did not set the appropriate context, allowing the use of System-scoped credentials otherwise reserved for use in the global configuration. This allowed users with Item/Configure permission on the folder to access credentials they're not entitled to, and potentially capture them. JIRA Plugin now defines the appopriate folder context for credential lookup. As a side effect, existing per-folder Jira sites may lose access to already configured System-scoped credentials, as if no credential was specified in the first place. Anchore Container Image Scanner Plugin stored credentials in plain text SECURITY-1539 / CVE-2019-16542 Anchore Container Image Scanner Plugin stored an Anchore.io service password unencrypted in job config.xml files as part of its configuration. This credential could be viewed by users with Extended Read permission or access to the master file system. As the affected functionality has been deprecated, and the affected Anchore.io service has been shut down in late 2018, the affected feature has been removed. The password will be removed from the job configuration once it is saved again. Spira Importer Plugin stored credentials in plain text SECURITY-1554 / CVE-2019-16543 Spira Importer Plugin stored a credential unencrypted in its global configuration file com.inflectra.spiratest.plugins.SpiraBuilder.xml on the Jenkins master. This credential could be viewed by users with access to the master file system. Spira Importer Plugin now stores this credential encrypted once its configuration is saved again. Google Compute Engine Plugin did not verify SSH host keys SECURITY-1584 / CVE-2019-16546 Google Compute Engine Plugin did not use SSH host key verification when connecting to VMs launched by the plugin. This lack of verification could be abused by a MitM attacker to intercept these connections to attacker-specified build agents without warning. Google Compute Engine Plugin now verifies SSH host keys before executing any commands on agents. Google Compute Engine Plugin disclosed environment information to users with Overall/Read permission SECURITY-1585 / CVE-2019-16547 Google Compute Engine Plugin did not verify permissions on multiple auto-complete API endpoints. This allowed users with Overall/Read permissions to view various metadata about the running cloud environment. Google Compute Engine Plugin now requires the appropriate Job/Configure permission to view these metadata. CSRF vulnerability in Google Compute Engine Plugin allowed provisioning agents SECURITY-1586 / CVE-2019-16548 Google Compute Engine Plugin did not require POST requests on an API endpoint. This CSRF vulnerability allowed attackers to provision new agents. Google Compute Engine Plugin now requires POST requests for this API endpoint. QMetry for JIRA - Test Management Plugin stored credentials in plain text SECURITY-727 (1) / CVE-2019-16544 QMetry for JIRA - Test Management Plugin stored credentials unencrypted in job config.xml files on the Jenkins master as part of its post-build step configuration. This credential could be viewed by users with Extended Read permission or access to the master file system. QMetry for JIRA - Test Management Plugin now stores these credentials encrypted once the job configuration is saved again. QMetry for JIRA - Test Management Plugin shows plain text password in configuration form SECURITY-727 (2) / CVE-2019-16545 QMetry for JIRA - Test Management Plugin stores a credential as part of its post-build step configuration. While the password is stored encrypted on disk since QMetry for JIRA - Test Management Plugin 1.13, it is transmitted in plain text as part of the configuration form. This can result in exposure of the password through browser extensions, cross-site scripting vulnerabilities, and similar situations. As of publication of this advisory, there is no fix. Severity o SECURITY-727 (1): Medium o SECURITY-727 (2): Low o SECURITY-1106: Medium o SECURITY-1539: Medium o SECURITY-1554: Low o SECURITY-1584: Medium o SECURITY-1585: Medium o SECURITY-1586: Medium o SECURITY-1634: High o SECURITY-1658: High Affected Versions o Anchore Container Image Scanner Plugin up to and including 1.0.19 o Google Compute Engine Plugin up to and including 4.1.1 o JIRA Plugin up to and including 3.0.10 o QMetry for JIRA - Test Management Plugin up to and including 1.12 o QMetry for JIRA - Test Management Plugin up to and including 1.13 o Script Security Plugin up to and including 1.67 o Spira Importer Plugin up to and including 3.2.2 o Support Core Plugin up to and including 2.63 Fix o Anchore Container Image Scanner Plugin should be updated to version 1.0.20 o Google Compute Engine Plugin should be updated to version 4.2.0 o JIRA Plugin should be updated to version 3.0.11 o QMetry for JIRA - Test Management Plugin should be updated to version 1.13 o Script Security Plugin should be updated to version 1.68 o Spira Importer Plugin should be updated to version 3.2.3 o Support Core Plugin should be updated to version 2.64 These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated. As of publication of this advisory, no fixes are available for the following plugins: o QMetry for JIRA - Test Management Plugin Credit The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities: o Daniel Beck, CloudBees, Inc. for SECURITY-1106, SECURITY-1634 o James Holderness, IB Boost for SECURITY-1539, SECURITY-1554 o Matt Sicker, CloudBees, Inc. for SECURITY-1584, SECURITY-1585, SECURITY-1586 o Nils Emmerich of ERNW Research GmbH for SECURITY-1658 - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBXddAO2aOgq3Tt24GAQhG7g//QZP2PshpimF4CXeTj3FD3OPukLzBPG33 XPF6PoSpTR6HWsPX4u6+eeJ117AYXKh3FDQ5Xh9oUhtQvytAABQP015nWVOe3Pa5 IC7kX0+4VV58THxhhH60PIhjIWbU5Mk/UIlbIlv/E+Ln5eviHGbqedg2tS0nQE4p sRNpbS3CG2hT4qlvKC9Vcn+xSHJpcHPE55jfQNYY4BYl62cMB4EAUI8EsYFJ0aEU xw3U81WC1bDG28P8A1bf0loohR4wbgaE/vvjo2LsZKUgxLMQukkPcEGBjl4WKvUG NLmRo6Aa/FpWg+2apflOK9xPfcOPtwPHfWZsenydDKPG5/dXyJNZRNtC1LojIzpU QfmCiQl1vGz/u8GbSlFBdw9zCffGJRyDJP34UPhafGkurbe+g8czsnJrruvhJFuW HdD+FyAwgO+bjpUXM+U22A1ee0GVAYLo/vps/oNGnnxE/ctzRdADdaxEU2qlTM78 /F6WTywP5t3UdbZvYGDpkjbuEGZ7QAk0pCwTjXosZcuObDJ+DpVtfVhgWe9wLoyo QIIc0y46NEmevVLx0xT3D+Hp3TUwglBD7ocR52z0fbcv8cgbE199FXFpjgMHyj1n KU9J5x274eRJ1G/VT+J4aDI4oCAxyTU3xcNYWzO0DGbjJ1ywZ5cE/qXdhvtR1wru PY1Vvy8QPS8= =7a2u -----END PGP SIGNATURE-----