Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2021.0969
Jenkins Security Advisory 2021-03-18
19 March 2021
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: CloudBees AWS Credentials Plugin 1.28.1
Libvirt Agents Plugin 1.9.1
Matrix Authorization Strategy Plugin 2.6.6
Role-based Authorization Strategy Plugin 3.1.1
Warnings Next Generation Plugin 8.5.0
Publisher: Jenkins
Operating System: Windows
UNIX variants (UNIX, Linux, OSX)
Impact/Access: Cross-site Request Forgery -- Remote with User Interaction
Access Confidential Data -- Existing Account
Unauthorised Access -- Existing Account
Reduced Security -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2021-21627 CVE-2021-21626 CVE-2021-21625
CVE-2021-21624 CVE-2021-21623
Original Bulletin:
https://www.jenkins.io/security/advisory/2021-03-18/
- --------------------------BEGIN INCLUDED TEXT--------------------
Jenkins Security Advisory 2021-03-18
This advisory announces vulnerabilities in the following Jenkins deliverables:
* CloudBees AWS Credentials Plugin
* Libvirt Agents Plugin
* Matrix Authorization Strategy Plugin
* Role-based Authorization Strategy Plugin
* Warnings Next Generation Plugin
Descriptions
Incorrect permission checks in Matrix Authorization Strategy Plugin may allow
accessing some items
SECURITY-2180 / CVE-2021-21623
Items (like jobs) can be organized hierarchically in Jenkins, using the Folders
Plugin or something similar. An item is expected to be accessible only if all
its ancestors are accessible as well.
Matrix Authorization Strategy Plugin 2.6.5 and earlier does not correctly
perform permission checks to determine whether an item should be accessible.
This allows attackers with Item/Read permission on nested items to access them,
even if they lack Item/Read permission for parent folders.
Matrix Authorization Strategy Plugin 2.6.6 requires Item/Read permission on
parent items to grant Item/Read permission on an individual item.
As a workaround in older releases, do not grant permissions on individual items
to users who do not have access to parent items.
In case of problems, the Java system property
hudson.security.AuthorizationMatrixProperty.checkParentPermissions can be set
to false, completely disabling this fix.
Incorrect permission checks in Role-based Authorization Strategy Plugin may
allow accessing some items
SECURITY-2182 / CVE-2021-21624
Items (like jobs) can be organized hierarchically in Jenkins, using the Folders
Plugin or something similar. An item is expected to be accessible only if all
its ancestors are accessible as well.
Role-based Authorization Strategy Plugin 3.1 and earlier does not correctly
perform permission checks to determine whether an item should be accessible.
This allows attackers with Item/Read permission on nested items to access them,
even if they lack Item/Read permission for parent folders.
Role-based Authorization Strategy Plugin 3.1.1 requires Item/Read permission on
parent items to grant Item/Read permission on an individual item.
As a workaround in older releases, do not grant permissions on individual items
to users who do not have access to parent items.
In case of problems, the Java system property
com.michelin.cio.hudson.plugins.rolestrategy.RoleMap.checkParentPermissions can
be set to false, completely disabling this fix.
Missing permission checks in CloudBees AWS Credentials Plugin allows
enumerating credentials IDs
SECURITY-2032 / CVE-2021-21625
CloudBees AWS Credentials Plugin 1.28 and earlier does not perform a permission
check in a helper method for HTTP endpoints.
This allows attackers with Overall/Read permission to enumerate credentials IDs
of AWS credentials stored in Jenkins if any of the following plugins are
installed:
* Amazon Elastic Container Service (ECS) / Fargate
* AWS Parameter Store Build Wrapper
* AWS SAM
Further plugins may use this helper method as well without performing a
permission check themselves.
Credentials IDs obtained this way can be used as part of an attack to capture
the credentials using another vulnerability.
CloudBees AWS Credentials Plugin 1.28.1 performs permission checks in the
helper method for HTTP endpoints.
Missing permission checks in Warnings Next Generation Plugin allow listing
workspace contents
SECURITY-2041 / CVE-2021-21626
Warnings Next Generation Plugin 8.4.4 and earlier does not perform permission
checks in methods implementing form validation.
This allows attackers with Item/Read permission but without Item/Workspace or
Item/Configure permission to check whether attacker-specified file patterns
match workspace contents. A sequence of requests can be used to effectively
list workspace contents.
Warnings Next Generation Plugin 8.5.0 requires Item/Configure permission to
validate patterns with workspace contents.
CSRF vulnerability in Libvirt Agents Plugin
SECURITY-1764 / CVE-2021-21627
Libvirt Agents Plugin 1.9.0 and earlier does not require POST requests for a
form submission endpoint, resulting in a cross-site request forgery (CSRF)
vulnerability.
This vulnerability allows attackers to stop hypervisor domains.
Libvirt Agents Plugin 1.9.1 requires POST requests for the affected HTTP
endpoint.
Severity
* SECURITY-1764: Medium
* SECURITY-2032: Medium
* SECURITY-2041: Medium
* SECURITY-2180: Medium
* SECURITY-2182: Medium
Affected Versions
* CloudBees AWS Credentials Plugin up to and including 1.28
* Libvirt Agents Plugin up to and including 1.9.0
* Matrix Authorization Strategy Plugin up to and including 2.6.5
* Role-based Authorization Strategy Plugin up to and including 3.1
* Warnings Next Generation Plugin up to and including 8.4.4
Fix
* CloudBees AWS Credentials Plugin should be updated to version 1.28.1
* Libvirt Agents Plugin should be updated to version 1.9.1
* Matrix Authorization Strategy Plugin should be updated to version 2.6.6
* Role-based Authorization Strategy Plugin should be updated to version 3.1.1
* Warnings Next Generation Plugin should be updated to version 8.5.0
These versions include fixes to the vulnerabilities described above. All prior
versions are considered to be affected by these vulnerabilities unless
otherwise indicated.
Credit
The Jenkins project would like to thank the reporters for discovering and
reporting these vulnerabilities:
* Daniel Beck, CloudBees, Inc. for SECURITY-2032, SECURITY-2041,
SECURITY-2182
* Wadeck Follonier, CloudBees, Inc. for SECURITY-1764
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBYFQCcuNLKJtyKPYoAQiSyxAAlY1XMlol6sZtf9dAHK5i+gKJsN9SFXzs
uKGcGCfC1ONnPDTox/9MgvXcxnTdLrlKQ24BqNXMN18Pele2jrfGFuBAnvv7kHCh
Nz+T8vi1iku3V/mmtokae0WGy4DXhpNgRvP+Ks4Ecb9Mx9Bx+jVmRjhnfv8O5wrg
2z/WTSnG7oJ5ISnZcRWj8+cMjFWJioDWpUU8XlfebziAJW9cqZoBrWG0fCfQ2P81
zoeQQgBedKYN9fpYN90LZ51R43BH2FHfqboDvRM1Os6QzCK/araXx0y98mcT7iVl
71tNj+kvLwrsl+TIEKDOSBs1Lo1sJ7aKd4gOfpY0W+N8ZdPf1a9qaL8TxPu8tjZw
fduRiKpWn2AR2ohhaTXMWYhFzoNWk1gg3a50RJu8k+cxcFjPOHOwzMoMe78jrXtW
r53Tv9bw1UmcrXoRwAdA3mu09GVLCb+61GsxcC30ZUON8kcH/uGm0X2sL6Afs7Ug
n902eaicfmRjINEXryCFVfeRaILhLFkhVZvdXPa6l5bhq840oeh7RRfzQog5Ka9g
jaWvQV505HxesS6wPcZGzrZapUpQQBjYyXoCN2U3dkDVV7R31L3LigEfUCV2Pk7/
sxNLIFWyqRsZJeckUnDQ7dv7B3FsLnfny4RBfUJc3NNIBuTMUcjMGk0SwdffwwwC
LukcZ9mjGWY=
=uVlm
-----END PGP SIGNATURE-----