-----BEGIN PGP SIGNED MESSAGE-----
AUSCERT External Security Bulletin Redistribution
Jenkins Security Advisory
8 April 2021
AusCERT Security Bulletin Summary
Product: Jenkins (core)
Micro Focus Application Automation Tools Plugin
promoted builds Plugin
Operating System: Windows
UNIX variants (UNIX, Linux, OSX)
Impact/Access: Cross-site Request Forgery -- Existing Account
Cross-site Scripting -- Remote with User Interaction
Provide Misleading Information -- Existing Account
Reduced Security -- Existing Account
CVE Names: CVE-2021-22513 CVE-2021-22512 CVE-2021-22511
CVE-2021-22510 CVE-2021-21641 CVE-2021-21640
- --------------------------BEGIN INCLUDED TEXT--------------------
Jenkins Security Advisory 2021-04-07
This advisory announces vulnerabilities in the following Jenkins deliverables:
o Jenkins (core)
o Micro Focus Application Automation Tools Plugin
o promoted builds Plugin
Lack of type validation in agent related REST API
SECURITY-1721 / CVE-2021-21639
Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type
of object created after loading the data submitted to the config.xml REST API
endpoint of a node.
This allows attackers with Computer/Configure permission to replace a node with
one of a different type.
Jenkins 2.287, LTS 2.277.2 validates the type of object created and rejects
objects of unexpected types.
View name validation bypass
SECURITY-1871 / CVE-2021-21640
Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that
a newly created view has an allowed name. When a form to create a view is
submitted, the name is included twice in the submission. One instance is
validated, but the other instance is used to create the value.
This allows attackers with View/Create permission to create views with invalid
or already-used names.
Jenkins 2.287, LTS 2.277.2 uses the same submitted value for validation and
CSRF vulnerability in promoted builds Plugin
SECURITY-2293 / CVE-2021-21641
promoted builds Plugin 3.9 and earlier does not require POST requests for HTTP
endpoints implementing promotion (regular, forced, and re-execute), resulting
in cross-site request forgery (CSRF) vulnerabilities.
These vulnerabilities allow attackers to promote builds.
promoted builds Plugin 3.9.1 requires POST requests for the affected HTTP
Note A security hardening since Jenkins 2.287 and LTS 2.277.2 prevents
exploitation of this vulnerability.
CSRF vulnerability and missing permission checks in Micro Focus Application
Automation Tools Plugin
SECURITY-2132 / CVE-2021-22512 (CSRF), CVE-2021-22513 (permission check)
Micro Focus Application Automation Tools Plugin 6.7 and earlier does not
perform permission checks in methods implementing form validation.
This allows attackers with Overall/Read permission to connect to
attacker-specified URLs using attacker-specified username and password.
Additionally, these form validation methods do not require POST requests,
resulting in a cross-site request forgery (CSRF) vulnerability.
Micro Focus Application Automation Tools Plugin 6.8 requires POST requests and
Overall/Administer permission for the affected form validation methods.
Reflected XSS vulnerability in Micro Focus Application Automation Tools Plugin
SECURITY-2175 / CVE-2021-22510
Micro Focus Application Automation Tools Plugin 6.7 and earlier does not escape
user input in a form validation response.
This results in a reflected cross-site scripting (XSS) vulnerability.
Micro Focus Application Automation Tools Plugin 6.8 escapes user input in the
affected form validation response.
Note A security hardening since Jenkins 2.275 and LTS 2.263.2 prevents
exploitation of this vulnerability.
SSL/TLS certificate validation unconditionally disabled by Micro Focus
Application Automation Tools Plugin
SECURITY-2176 / CVE-2021-22511
Micro Focus Application Automation Tools Plugin 6.7 and earlier unconditionally
disables SSL/TLS certificate validation for connections to Service
Micro Focus Application Automation Tools Plugin 6.8 no longer disables SSL/TLS
certificate validation unconditionally by default. It provides an option to
disable SSL/TLS certification validation for connections to Service
o SECURITY-1721: Low
o SECURITY-1871: Medium
o SECURITY-2132: Medium
o SECURITY-2175: High
o SECURITY-2176: Medium
o SECURITY-2293: Medium
o Jenkins weekly up to and including 2.286
o Jenkins LTS up to and including 2.277.1
o Micro Focus Application Automation Tools Plugin up to and including 6.7
o promoted builds Plugin up to and including 3.9
o Jenkins weekly should be updated to version 2.287
o Jenkins LTS should be updated to version 2.277.2
o Micro Focus Application Automation Tools Plugin should be updated to
o promoted builds Plugin should be updated to version 3.9.1
These versions include fixes to the vulnerabilities described above. All prior
versions are considered to be affected by these vulnerabilities unless
The Jenkins project would like to thank the reporters for discovering and
reporting these vulnerabilities:
o Ildefonso Montero Perez, CloudBees, Inc. and Daniel Beck, CloudBees, Inc.
o Jeff Thompson, CloudBees, Inc. for SECURITY-1721
o Long Nguyen, Viettel Cyber Security for SECURITY-2132
o Wadeck Follonier, CloudBees, Inc. for SECURITY-2175, SECURITY-2176
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to email@example.com
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
Australian Computer Emergency Response Team
The University of Queensland
Internet Email: firstname.lastname@example.org
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
-----BEGIN PGP SIGNATURE-----
-----END PGP SIGNATURE-----