CloudBees Security Advisories

Masters now only support SSO requests from Hosts (or X-Forwarded-Host) matching the configured Jenkins Root URL. This issue is due to an incomplete fix of CTR-1098, announced in 2020-03-09 and wrongly called"CSRF in Authentication Mechanism in SSO".

IMPROPER MASKING OF SOME SECRETS IN CREDENTIALS BINDING PLUGIN SECURITY-1835 / CVE-2020-2182 Credentials Binding Plugin allows specifying passwords and other secrets as environment variables, and will hide them from console output in builds.

MISSING PERMISSION CHECK LEADS TO SSRF IN “VMWARE AUTOSCALING PLUGIN” CTR-1293 When using the Test Connection feature on the VMware Pools page, a missing permission check allowed a user without CONFIGURE permissions to call the validation endpoint, leading ...

JENKINS SECURITY ADVISORY 2020-04-16 This advisory announces vulnerabilities in Jenkins CREDENTIALS STORED IN PLAIN TEXT BY COPR PLUGIN SECURITY-1556 / CVE-2020-2177 Copr Plugin 0.3 and earlier stores credentials unencrypted in job config.xml files as part ...

This allows a user able to control the input files for the"Publish Coverage Report" post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins master or server-side request forgery.

This allows a user able to control the input files for the 'RapidDeploy deployment package build' build or post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins master, server-side reque ...

Script Security Plugin 1.71 has additional restrictions and sanity checks to ensure that super constructors cannot be constructed without being intercepted by the sandbox.

INFORMATION DISCLOSURE IN CLOUDBEES AMAZON AWS CLI PLUGIN CTR-1006 A user with permission to see a job could list the AWS credential IDs available for a job, without the expected permission.

This form validation method requires POST requests and Item/Configure permission in Pipeline GitHub Notify Step Plugin 1.0.5. USERS WITH OVERALL/READ ACCESS CAN ENUMERATE CREDENTIAL IDS IN PIPELINE GITHUB NOTIFY STEP PLUGIN SECURITY-812 (2) / CVE-2020-2118 ...

The UDP multicast/broadcast service can be used in an amplification reflection attack, as very few bytes sent to the respective endpoint result in much larger responses: A single byte request to this service would respond with more than 100 bytes of Jenkin ...

This allows a user able to control the input files for the 'Publish Robot Framework' post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins master, server-side request forgery, or denial- ...

SSL/TLS CERTIFICATE VALIDATION GLOBALLY AND UNCONDITIONALLY DISABLED BY WEBSPHERE DEPLOYER PLUGIN SECURITY-1581 / CVE-2019-16561 WebSphere Deployer Plugin 1.6.1 and earlier allows users with Overall/Read access to disable SSL/TLS certificate and hostname v ...