This advisory announces vulnerabilities inJenkins, CloudBees Jenkins Distribution, CloudBees Jenkins Platform and CloudBees Core.
Stored XSS vulnerability in expandable textbox form control
SECURITY-1498 / CVE-2019-10401
Jenkins form controls include an expandable textbox that can transform from a single-line text box to a multi-line text area.
The implementation of this transformation interpreted the text content of the form field as HTML. This resulted in a cross-site scripting vulnerability exploitable by attackers able to control the contents of such f:expandableTextbox form controls.
Jenkins no longer interprets f:expandableTextbox text content as HTML when transforming it.
XSS vulnerability in combobox form control
SECURITY-1525 / CVE-2019-10402
Jenkins interpreted items added to f:combobox form controls as HTML. This resulted in a cross-site scripting vulnerability exploitable by attackers able to control the contents of f:combobox form controls.
Jenkins no longer interprets items added to a combobox as HTML.
This might be a breaking change for plugins that relied on the previous, undocumented behavior to add formatting to |
Stored XSS vulnerability in SCM tag action tooltip
SECURITY-1537 (1) / CVE-2019-10403
Jenkins did not escape the tag name on the tooltip for tag actions shown in the build history. This resulted in a cross-site scripting vulnerability exploitable by attackers able to control the SCM tag name for these actions.
Jenkins now escapes the SCM tag action.
Stored XSS vulnerability in queue item tooltip
SECURITY-1537 (2) / CVE-2019-10404
Jenkins did not escape the reason a queue item is blocked in tooltips. This resulted in a cross-site scripting vulnerability exploitable by attackers able to control the reason a queue item is blocked, for example a label expression that does not match idle executors.
Jenkins now escapes the reason a queue item is blocked in tooltips.
Diagnostic web page exposed Cookie HTTP header
SECURITY-1505 / CVE-2019-10405
Jenkins shows various technical information about the current user on the /whoAmI URL. The information shown includes HTTP request headers.
This allowed attackers able to exploit another cross-site scripting vulnerability to obtain the Cookie header’s value even if the HttpOnly flag would prevent direct access via JavaScript.
Jenkins no longer shows the value of the Cookie HTTP header on the /whoAmI URL.
XSS vulnerability in Jenkins URL setting
SECURITY-1471 / CVE-2019-10406
Jenkins did not validate or otherwise limit the possible values administrators could specify as Jenkins root URL.
This resulted in a cross-site scripting vulnerability exploitable by users with Overall/Administer permission.
Jenkins now prevents values other than HTTP/HTTPS URLs from being set as Jenkins root URL. Existing instances with invalid root URLs will behave as if no root URL was set.
In case this results in problems, e.g. a valid URL unexpectedly being rejected, set the system property |
Project Inheritance Plugin showed secret environment variables defined in Mask Passwords Plugin
SECURITY-351 / CVE-2019-10407
Mask Passwords Plugin allows users to define secret environment variables (typically passwords) to be passed to builds, both globally, and for specific jobs. These environment variables are expected to not be shown.
Project Inheritance Plugin showed the variable values on its Full Build Flow view and included them in the metadata download without masking.
Project Inheritance Plugin no longer shows variables contributed from Mask Password Plugin without masking.
CSRF vulnerability and missing permission check in Project Inheritance Plugin
SECURITY-401 / CVE-2019-10408 (CSRF), CVE-2019-10409 (permission check)
Project Inheritance Plugin allows the creation of projects based on templates defined in the plugin configuration.
A missing permission check in the HTTP endpoint triggering project creation allowed users with Overall/Read permission to create these projects. Additionally, the HTTP endpoint did not require POST requests, resulting in a CSRF vulnerability.
The HTTP endpoint triggering project creation now requires Item/Create permission and submission of requests via POST.
Stored XSS vulnerability in Log Parser Plugin
SECURITY-732 / CVE-2019-10410
Log Parser Plugin did not escape an error message shown when log parsing patterns are invalid. This resulted in a persisted cross-site scripting vulnerability exploitable by attackers able to control the log parsing rules configuration, typically users with Job/Configure permission.
Jenkins applies the missing escaping by default since 2.146 and LTS 2.138.2, so newer Jenkins releases are not affected by this vulnerability.
Log Parser Plugin now escapes all variables displayed in its views.
NeuVector Vulnerability Scanner Plugin stored credentials in plain text
SECURITY-1504 / CVE-2019-10430
NeuVector Vulnerability Scanner Plugin stored registry credentials unencrypted in its global configuration file io.jenkins.plugins.neuvector.NeuVectorBuilder.xml on the Jenkins master. These credentials could be viewed by users with access to the master file system.
NeuVector Vulnerability Scanner Plugin now stores these credentials encrypted.
Aqua MicroScanner Plugin showed plain text credential in configuration form
SECURITY-1507 / CVE-2019-10427
Aqua MicroScanner Plugin stores a token credential in its global Jenkins configuration.
While the token is stored encrypted on disk, it was transmitted in plain text as part of the configuration form. This could result in exposure of the token through browser extensions, cross-site scripting vulnerabilities, and similar situations.
Aqua MicroScanner Plugin now encrypts the token transmitted to administrators viewing the global configuration form.
Aqua Security Scanner Plugin showed plain text password in configuration form
SECURITY-1508 / CVE-2019-10428
Aqua Security Scanner Plugin stores a password in its global Jenkins configuration.
While the password is stored encrypted on disk, it was transmitted in plain text as part of the configuration form. This could result in exposure of the password through browser extensions, cross-site scripting vulnerabilities, and similar situations.
Aqua Security Scanner Plugin now encrypts the password transmitted to administrators viewing the global configuration form.
Inedo BuildMaster Plugin Plugin showed plain text password in configuration form
SECURITY-1513 / CVE-2019-10411
Inedo BuildMaster Plugin Plugin stores a service password in its global Jenkins configuration.
While the password is stored encrypted on disk, it was transmitted in plain text as part of the configuration form. This could result in exposure of the password through browser extensions, cross-site scripting vulnerabilities, and similar situations.
Inedo BuildMaster Plugin Plugin now encrypts the password transmitted to administrators viewing the global configuration form.
Inedo ProGet Plugin Plugin showed plain text password in configuration form
SECURITY-1514 / CVE-2019-10412
Inedo ProGet Plugin Plugin stores a service password in its global Jenkins configuration.
While the password is stored encrypted on disk, it was transmitted in plain text as part of the configuration form. This could result in exposure of the password through browser extensions, cross-site scripting vulnerabilities, and similar situations.
Inedo ProGet Plugin Plugin now encrypts the password transmitted to administrators viewing the global configuration form.
Data Theorem: CI/CD Plugin stored credentials in plain text
SECURITY-1557 / CVE-2019-10413
Data Theorem: CI/CD Plugin stored a proxy password unencrypted in job config.xml files on the Jenkins master. This password could be viewed by users with Extended Read permission, or access to the master file system.
Data Theorem: CI/CD Plugin now stores the proxy password encrypted. Existing jobs need to have their configuration saved for existing plain text proxy passwords to be overwritten.
Git Changelog Plugin stored credentials in plain text
SECURITY-1574 / CVE-2019-10414
Git Changelog Plugin stored MediaWiki and Jira passwords unencrypted in job config.xml files on the Jenkins master. These passwords could be viewed by users with Extended Read permission, or access to the master file system.
Git Changelog Plugin now stores these passwords encrypted. Existing jobs need to have their configuration saved for existing plain text passwords to be overwritten.
GitLab Logo Plugin stored credentials in plain text
SECURITY-1575 / CVE-2019-10429
GitLab Logo Plugin stored a private token unencrypted in its global configuration file org.jenkinsci.plugins.gitlablogo.GitlabLogoProperty.xml on the Jenkins master. This token could be viewed by users with access to the master file system.
GitLab Logo Plugin now stores the token encrypted.
Violation Comments to GitLab Plugin stored credentials in plain text
SECURITY-1577 / CVE-2019-10415 (global password), CVE-2019-10416 (job password)
Violation Comments to GitLab Plugin stored API tokens unencrypted in job config.xml files and its global configuration file org.jenkinsci.plugins.jvctgl.ViolationsToGitLabGlobalConfiguration.xml on the Jenkins master. These credentials could be viewed by users with Extended Read permission, or access to the master file system.
Violation Comments to GitLab Plugin now stores these credentials encrypted. Existing jobs need to have their configuration saved for existing plain text credentials to be overwritten.
Script sandbox bypass vulnerability in Kubernetes Pipeline - Kubernetes Steps Plugin
SECURITY-920 (1) / CVE-2019-10417
Kubernetes Pipeline - Kubernetes Steps Plugin defines a custom whitelist for all scripts protected by the Script Security sandbox.
This custom whitelist allows the use of methods that can be used to bypass Script Security sandbox protection. This results in arbitrary code execution on any Jenkins instance with this plugin installed.
As of publication of this advisory, there is no fix.
Script sandbox bypass vulnerability in Kubernetes Pipeline - Arquillian Steps Plugin
SECURITY-920 (2) / CVE-2019-10418
Kubernetes Pipeline - Arquillian Steps Plugin defines a custom whitelist for all scripts protected by the Script Security sandbox.
This custom whitelist allows the use of methods that can be used to bypass Script Security sandbox protection. This results in arbitrary code execution on any Jenkins instance with this plugin installed.
As of publication of this advisory, there is no fix.
vFabric Application Director Plugin stores credentials in plain text
SECURITY-1541 / CVE-2019-10419
vFabric Application Director Plugin stores the Application Director password unencrypted in its global configuration file jfullam.vfabric.jenkins.plugin.ApplicationDirectorPostBuildDeployer.xml on the Jenkins master. This password can be viewed by users with access to the master file system.
As of publication of this advisory, there is no fix.
Assembla Plugin stores credentials in plain text
SECURITY-1543 / CVE-2019-10420
Assembla Plugin stores the Assembla password unencrypted in its global configuration file jenkins.plugin.assembla.AssemblaProjectProperty.xml on the Jenkins master. This password can be viewed by users with access to the master file system.
As of publication of this advisory, there is no fix.
Azure Event Grid Build Notifier Plugin stores credentials in plain text
SECURITY-1544 / CVE-2019-10421
Azure Event Grid Build Notifier Plugin stores the Azure Event Grid secret key unencrypted in job config.xml files on the Jenkins master. This key can be viewed by users with Extended Read permission, or access to the master file system.
As of publication of this advisory, there is no fix.
Call Remote Job Plugin stores credentials in plain text
SECURITY-1548 / CVE-2019-10422
Call Remote Job Plugin stores a password unencrypted in job config.xml files on the Jenkins master. This password can be viewed by users with Extended Read permission, or access to the master file system.
As of publication of this advisory, there is no fix.
CodeScan Plugin stores credentials in plain text
SECURITY-1551 / CVE-2019-10423
CodeScan Plugin stores an API key unencrypted in its global configuration file com.villagechief.codescan.jenkins.CodeScanBuilder.xml on the Jenkins master. This API key can be viewed by users with access to the master file system.
As of publication of this advisory, there is no fix.
elOyente Plugin stores credentials in plain text
SECURITY-1561 / CVE-2019-10424
elOyente Plugin stores a password unencrypted in its global configuration file com.technicolor.eloyente.ElOyente.xml on the Jenkins master. This password can be viewed by users with access to the master file system.
As of publication of this advisory, there is no fix.
Google Calendar Plugin stores credentials in plain text
SECURITY-1572 / CVE-2019-10425
Google Calendar Plugin stores a calendar password unencrypted in job config.xml files on the Jenkins master. This password can be viewed by users with Extended Read permission, or access to the master file system.
As of publication of this advisory, there is no fix.
Gem Publisher Plugin stores credentials in plain text
SECURITY-1573 / CVE-2019-10426
Gem Publisher Plugin stores an API key unencrypted in its global configuration file net.arangamani.jenkins.gempublisher.GemPublisher.xml on the Jenkins master. This API key can be viewed by users with access to the master file system.
As of publication of this advisory, there is no fix.