CloudBees Security Advisory 2017-04-27

This advisory announces a vulnerability in the Git Client Plugin.

SECURITY-445

Temporary files were previously written to the Java temporary directory with default permissions. A malicious actor with local file access could have captured sensitive information by reading files from that directory. The temporary files typically are only on the file system for the duration of a single command line git invocation, but cloning a large Git repo could require an extended time with those sensitive files in the temporary directory.

This change sets permissions on the temporary files to be readable only by the file owner. If a workspace is available, a temporary directory adjacent to the workspace is used instead of the system temporary directory.

As a workaround, setting the system property java.io.tmpdir on Jenkins master and agents to a directory only accessible by the Jenkins process’s user would prevent this issue.

• SECURITY-445: low .

Users of Git Client Plugin should update it to version 2.4.4 or newer:

• CloudBees Jenkins Enterprise:

  • For users in version 1.6.3 with CAP enabled, Beekeeper will offer the update (only for Managed Masters running version 2.46.2.1).

  • Users in versions older than 1.6.3 should upgrade to 1.6.3.

  • Users with CAP disabled can update the plugin through the Plugin Manager.

• CloudBees Jenkins Platform (rolling train, CloudBees Jenkins Operations Center and CloudBees Jenkins Enterprise 2.x.y.z):

  • For users in version 2.46.2.1 with CAP enabled, Beekeeper will offer the update (only for Client Masters).

  • Users in versions older than 2.46.2.1 should upgrade to 2.46.2.1

  • Users with CAP disabled can get the plugin version including the fix through the Plugin Manager.

• CloudBees Jenkins Platform (fixed train, CloudBees Jenkins Operations Center and CloudBees Jenkins Enterprise 2.7.x.0.y), users should upgrade to version 2.7.24.0.2.

• CloudBees Jenkins Platform: CloudBees Jenkins Operations Center 1.625.x.y and CloudBees Jenkins Enterprise 1.651.x.y:

  • Users can update the plugin through the Plugin Manager.

• CloudBees Jenkins Team:

  • For users in version 2.46.2.1 with CAP enabled, Beekeeper will offer the update.

  • Users in versions older than 2.46.2.1 should upgrade to 2.46.2.1

  • Users with CAP disabled can update the plugin through the Plugin Manager.

• DEV@cloud is not affected.