SECURITY-2020 / CVE-2020-2279
Script Security Plugin provides a sandbox feature that allows low privileged users to define scripts, including Pipelines, that are generally safe to execute. Calls to code defined inside a sandboxed script are intercepted, and various allowlists are checked to determine whether the call is to be allowed.
In Script Security Plugin 1.74 and earlier, any calls from outside a sandboxed script to code defined inside a sandboxed script were always allowed. As sandboxed scripts can communicate their results through script return values and similar mechanisms, this could result in code defined inside of a sandboxed script to be called without sandbox protection.
This vulnerability allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
Script Security Plugin 1.75 will prevent code defined inside a sandbox from being invoked outside a sandboxed script.
In rare cases, invocations of sandboxed scripts may begin failing if the script return value or script binding include code defined in the sandbox and is further processed by the calling code. To resolve this issue, the affected values need to be converted inside the sandboxed script to a known safe type, such as
For compatibility with this change, the following plugins should be upgraded to the versions specified:
Email Extension Plugin should be updated at least to version 2.69.2 or newer for rolling line (2.249) and fixed 2.222 and at least to version 2.68.2 for fixed 2.190.
Warnings Next Generation Plugin should be updated to version 126.96.36.199 or newer for rolling line (2.249).
Warnings Plugin should be updated to version 5.0.2 or newer for rolling line (2.249).
CloudBees Template Plugin should be updated to version 4.45.1 or newer for rolling line (2.249) and fixed 2.222 and at least to version 4.43.2 for fixed 2.190.
All these upgrades are included inside incremental versions involved in this advisory:
SECURITY-2042 / CVE-2020-2280
Warnings Plugin 5.0.1 and earlier does not require POST requests for a form validation method intended for testing custom warnings parsers, resulting in a cross-site request forgery (CSRF) vulnerability.
This vulnerability allows attackers to execute arbitrary code.
Warnings Plugin 5.0.2 requires POST requests for the affected form validation method.
This vulnerability was caused by an incomplete fix to SECURITY-1295.
SECURITY-1958 / CVE-2020-2281
Lockable Resources Plugin 2.8 and earlier does not require POST requests for several HTTP endpoints, resulting in a cross-site request forgery (CSRF) vulnerability.
This vulnerability allows attackers to reserve, unreserve, unlock, and reset resources.
Lockable Resources Plugin 2.9 requires POST requests for the affected HTTP endpoints.
SECURITY-2004 / CVE-2020-2282
Implied Labels Plugin 0.6 and earlier does not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to configure the plugin.
Implied Labels Plugin 0.7 requires Overall/Administer permission to configure the plugin.
SECURITY-1885 / CVE-2020-2283
Liquibase Runner Plugin 1.4.5 and earlier does not escape changeset contents when showing them on the build page.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide Liquibase changesets evaluated by the plugin.
Liquibase Runner Plugin 1.4.7 no longer supports evaluating changesets.
SECURITY-1887 / CVE-2020-2284
Liquibase Runner Plugin 1.4.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
This allows attackers able to provide Liquibase changesets evaluated by the plugin to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Liquibase Runner Plugin 1.4.7 no longer parses Liquibase changesets.
SECURITY-2030 / CVE-2020-2285
Liquibase Runner Plugin 1.4.7 and earlier does not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.
An enumeration of credentials IDs in Liquibase Runner Plugin 1.4.8 requires the appropriate permissions.