Security Advisory Impact
CloudBees Security Advisory 2020-11-12
This advisory announces vulnerabilities in CloudBees Jenkins Distribution, CloudBees Jenkins Platform and CloudBees CI
OC items in nested folders did not have their RBAC configuration correctly migrated
A previous version update caused an issue with Operations Center items in nested folders RBAC configurations.
Now an additional migration of the RBAC configuration for all the OC items in the Jenkins instance not just the items defined at the top level.
Permissions are not correctly applied if RBAC on Views is disabled
RBAC permissions were not applied correctly when RBAC on views is disabled(CTR-2748)::
Since the November rolling release (188.8.131.52), it's not possible to define groups on views, so the expected permissions set should be coming from the view's parent item. However there was a bug which made the permission set to be the root one (ie. whatever is defined at root level).
The fix is making the view use the permission set coming from the view's owner. So if the view is inside a folder, then the folder groups and roles are applied. Or if the view is on the root level, the global groups and roles are applied.
CloudBees Traditional Platforms should be upgraded 184.108.40.206
CloudBees Cloud Platforms should be upgraded 220.127.116.11
CloudBees Jenkins Enterprise should be upgraded the Managed Masters and Operations Center to 18.104.22.168
CloudBees Jenkins Platform (rolling train, CJP Operations Center and CJP Client Master (2.x.y.z) should be upgraded to version 22.214.171.124
CloudBees Jenkins Platform (fixed train, CJP Operations Center and CJP Client Master (2.222.x.0.z) should be upgraded to version 126.96.36.199.1-rev6
CloudBees Jenkins Platform (fixed train, CJP Operations Center and CJP Client Master (2.190.x.0.z) should be upgraded to version 188.8.131.52.2-rev6