-----BEGIN PGP SIGNED MESSAGE-----
AUSCERT External Security Bulletin Redistribution
Jenkins Security Advisory 2019-11-21
22 November 2019
AusCERT Security Bulletin Summary
Product: Jenkins plugins
Operating System: UNIX variants (UNIX, Linux, OSX)
Impact/Access: Execute Arbitrary Code/Commands -- Existing Account
Delete Arbitrary Files -- Existing Account
Cross-site Scripting -- Remote with User Interaction
Access Confidential Data -- Existing Account
Unauthorised Access -- Existing Account
CVE Names: CVE-2019-16548 CVE-2019-16547 CVE-2019-16546
CVE-2019-16545 CVE-2019-16544 CVE-2019-16543
CVE-2019-16542 CVE-2019-16541 CVE-2019-16540
- --------------------------BEGIN INCLUDED TEXT--------------------
Jenkins Security Advisory 2019-11-21
This advisory announces vulnerabilities in the following Jenkins deliverables:
o Anchore Container Image Scanner Plugin
o Google Compute Engine Plugin
o JIRA Plugin
o QMetry for JIRA - Test Management Plugin
o Script Security Plugin
o Spira Importer Plugin
o Support Core Plugin
Sandbox bypass vulnerability in Script Security Plugin
SECURITY-1658 / CVE-2019-16538
Sandbox protection in Script Security Plugin could be circumvented through
closure default parameter expressions.
This allowed attackers able to specify and run sandboxed scripts to execute
arbitrary code in the context of the Jenkins master JVM.
These expressions are now subject to sandbox protection.
Support Core Plugin allowed users with Overall/Read permission to delete
SECURITY-1634 / CVE-2019-16539 (permission check), CVE-2019-16540 (path
Support Core Plugin did not validate the paths submitted for the "Delete
Support Bundles" feature. This allowed users to delete arbitrary files on the
Jenkins master file system accessible to the OS user account running Jenkins.
Additionally, this endpoint did not perform a permission check, allowing users
with Overall/Read permission to delete support bundles, and any arbitrary other
file, with a known name/path.
Support Core Plugin now only allows the deletion of support bundles and related
files listed on the UI through this feature. It also ensures that only users
with "Download Bundle" permission are able to delete support bundles.
Folder-scoped Jira sites in JIRA Plugin were able to access System-scoped
SECURITY-1106 / CVE-2019-16541
JIRA Plugin allows the definition of per-folder Jira sites.
The credentials lookup for this feature did not set the appropriate context,
allowing the use of System-scoped credentials otherwise reserved for use in the
global configuration. This allowed users with Item/Configure permission on the
folder to access credentials they're not entitled to, and potentially capture
JIRA Plugin now defines the appopriate folder context for credential lookup. As
a side effect, existing per-folder Jira sites may lose access to already
configured System-scoped credentials, as if no credential was specified in the
Anchore Container Image Scanner Plugin stored credentials in plain text
SECURITY-1539 / CVE-2019-16542
Anchore Container Image Scanner Plugin stored an Anchore.io service password
unencrypted in job config.xml files as part of its configuration. This
credential could be viewed by users with Extended Read permission or access to
the master file system.
As the affected functionality has been deprecated, and the affected Anchore.io
service has been shut down in late 2018, the affected feature has been removed.
The password will be removed from the job configuration once it is saved again.
Spira Importer Plugin stored credentials in plain text
SECURITY-1554 / CVE-2019-16543
Spira Importer Plugin stored a credential unencrypted in its global
configuration file com.inflectra.spiratest.plugins.SpiraBuilder.xml on the
Jenkins master. This credential could be viewed by users with access to the
master file system.
Spira Importer Plugin now stores this credential encrypted once its
configuration is saved again.
Google Compute Engine Plugin did not verify SSH host keys
SECURITY-1584 / CVE-2019-16546
Google Compute Engine Plugin did not use SSH host key verification when
connecting to VMs launched by the plugin. This lack of verification could be
abused by a MitM attacker to intercept these connections to attacker-specified
build agents without warning.
Google Compute Engine Plugin now verifies SSH host keys before executing any
commands on agents.
Google Compute Engine Plugin disclosed environment information to users with
SECURITY-1585 / CVE-2019-16547
Google Compute Engine Plugin did not verify permissions on multiple
auto-complete API endpoints. This allowed users with Overall/Read permissions
to view various metadata about the running cloud environment.
Google Compute Engine Plugin now requires the appropriate Job/Configure
permission to view these metadata.
CSRF vulnerability in Google Compute Engine Plugin allowed provisioning agents
SECURITY-1586 / CVE-2019-16548
Google Compute Engine Plugin did not require POST requests on an API endpoint.
This CSRF vulnerability allowed attackers to provision new agents.
Google Compute Engine Plugin now requires POST requests for this API endpoint.
QMetry for JIRA - Test Management Plugin stored credentials in plain text
SECURITY-727 (1) / CVE-2019-16544
QMetry for JIRA - Test Management Plugin stored credentials unencrypted in job
config.xml files on the Jenkins master as part of its post-build step
configuration. This credential could be viewed by users with Extended Read
permission or access to the master file system.
QMetry for JIRA - Test Management Plugin now stores these credentials encrypted
once the job configuration is saved again.
QMetry for JIRA - Test Management Plugin shows plain text password in
SECURITY-727 (2) / CVE-2019-16545
QMetry for JIRA - Test Management Plugin stores a credential as part of its
post-build step configuration.
While the password is stored encrypted on disk since QMetry for JIRA - Test
Management Plugin 1.13, it is transmitted in plain text as part of the
configuration form. This can result in exposure of the password through browser
extensions, cross-site scripting vulnerabilities, and similar situations.
As of publication of this advisory, there is no fix.
o SECURITY-727 (1): Medium
o SECURITY-727 (2): Low
o SECURITY-1106: Medium
o SECURITY-1539: Medium
o SECURITY-1554: Low
o SECURITY-1584: Medium
o SECURITY-1585: Medium
o SECURITY-1586: Medium
o SECURITY-1634: High
o SECURITY-1658: High
o Anchore Container Image Scanner Plugin up to and including 1.0.19
o Google Compute Engine Plugin up to and including 4.1.1
o JIRA Plugin up to and including 3.0.10
o QMetry for JIRA - Test Management Plugin up to and including 1.12
o QMetry for JIRA - Test Management Plugin up to and including 1.13
o Script Security Plugin up to and including 1.67
o Spira Importer Plugin up to and including 3.2.2
o Support Core Plugin up to and including 2.63
o Anchore Container Image Scanner Plugin should be updated to version 1.0.20
o Google Compute Engine Plugin should be updated to version 4.2.0
o JIRA Plugin should be updated to version 3.0.11
o QMetry for JIRA - Test Management Plugin should be updated to version 1.13
o Script Security Plugin should be updated to version 1.68
o Spira Importer Plugin should be updated to version 3.2.3
o Support Core Plugin should be updated to version 2.64
These versions include fixes to the vulnerabilities described above. All prior
versions are considered to be affected by these vulnerabilities unless
As of publication of this advisory, no fixes are available for the following
o QMetry for JIRA - Test Management Plugin
The Jenkins project would like to thank the reporters for discovering and
reporting these vulnerabilities:
o Daniel Beck, CloudBees, Inc. for SECURITY-1106, SECURITY-1634
o James Holderness, IB Boost for SECURITY-1539, SECURITY-1554
o Matt Sicker, CloudBees, Inc. for SECURITY-1584, SECURITY-1585,
o Nils Emmerich of ERNW Research GmbH for SECURITY-1658
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to email@example.com
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
Australian Computer Emergency Response Team
The University of Queensland
Internet Email: firstname.lastname@example.org
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
-----BEGIN PGP SIGNATURE-----
-----END PGP SIGNATURE-----