来源：Jenkins官网
发布日期：2020-03-25
阅读次数：1029
评论：0
更新标题
Jenkins Security Advisory 2020-03-25
更新详情
CSRF protection for any URL could be bypassedSECURITY-1774
/
CVE-2020-2160An extension point in Jenkins allows selectively disabling cross-site request forgery (CSRF) protection for specific URLs.Implementations of that extension point received a different representation of the URL path than the Stapler web framework uses to dispatch requests in Jenkins 2.227 and earlier, LTS 2.204.5 and earlier.
This discrepancy allowed attackers to craft URLs that would bypass the CSRF protection of any target URL.Jenkins now uses the same representation of the URL path to decide whether CSRF protection is needed for a given URL as the Stapler web framework uses.NoteIn case of problems, administrators can disable this security fix by setting the system property hudson.security.csrf.CrumbFilter.UNPROCESSED_PATHINFO to true.NoteAs an additional safeguard, semicolon (;) characters in the path part of a URL are now banned by default.
Administrators can disable this protection by setting the system property jenkins.security.SuspiciousRequestFilter.allowSemicolonsInPath to true.Stored XSS vulnerability in label expression validationSECURITY-1781
/
CVE-2020-2161Users with Agent/Configure permissions can define labels for nodes.
These labels can be referenced in job configurations to restrict where a job can be run.In Jenkins 2.227 and earlier, LTS 2.204.5 and earlier, the form validation for label expressions in job configuration forms did not properly escape label names, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users able to define node labels.Jenkins now correctly escapes node labels that are shown in form validation on job configuration pages.Stored XSS vulnerability in file parametersSECURITY-1793
/
CVE-2020-2162Jenkins 2.227 and earlier, LTS 2.204.5 and earlier served files uploaded as file parameters to a build without specifying appropriate Content-Security-Policy HTTP headers.
This resulted in a stored cross-site scripting (XSS) vulnerability exploitable by users with permissions to build a job with file parameters.Jenkins now sets Content-Security-Policy HTTP headers when serving files uploaded via a file parameter to the same value as used for files in workspaces and archived artifacts not served using the Resource Root URL.The system property hudson.model.DirectoryBrowserSupport.CSP can be set to override the value of Content-Security-Policy headers sent when serving these files.
This is the same system property used for files in workspaces and archived artifacts unless those are served via the Resource Root URL and works the same way for file parameters.
See Configuring Content Security Policy to learn more.NoteEven when Jenkins is configured to serve files in workspaces and archived artifacts using the Resource Root URL (introduced in Jenkins 2.200), file parameters are not, and therefore still subject to Content-Security-Policy restrictions.Stored XSS vulnerability in list view column headersSECURITY-1796
/
CVE-2020-2163Jenkins 2.227 and earlier, LTS 2.204.5 and earlier processed HTML embedded in list view column headers.
This resulted in a stored cross-site scripting (XSS) vulnerability exploitable by users able to control the content of column headers.The following plugins are known to allow users to define column headers:Warnings NGMaven InfoLink ColumnFurther plugins may also allow users to define column headers.Jenkins no longer processes HTML embedded in list view column headers.Passwords stored in plain text by Artifactory PluginSECURITY-1542 (1)
/
CVE-2020-2164Artifactory Plugin 3.5.0 and earlier stores its Artifactory server password in plain text in the global configuration file org.jfrog.hudson.ArtifactoryBuilder.xml.
This password can be viewed by users with access to the Jenkins master file system.Artifactory Plugin 3.6.0 now stores the Artifactory server password encrypted.
This change is effective once the global configuration is saved the next time.Passwords transmitted in plain text by Artifactory PluginSECURITY-1542 (2)
/
CVE-2020-2165Artifactory Plugin stores Artifactory server passwords in its global configuration file org.jfrog.hudson.ArtifactoryBuilder.xml on the Jenkins master as part of its configuration.While the password is stored encrypted on disk since Artifactory Plugin 3.6.0, it is transmitted in plain text as part of the configuration form by Artifactory Plugin 3.6.0 and earlier.
This can result in exposure of the password through browser extensions, cross-site scripting vulnerabilities, and similar situations.Artifactory Plugin 3.6.1 transmits the password in its global configuration encrypted.RCE vulnerability in Pipeline: AWS Steps PluginSECURITY-1741
/
CVE-2020-2166Pipeline: AWS Steps Plugin 1.40 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types.
This results in a remote code execution (RCE) vulnerability exploitable by users able to provide YAML input files to Pipeline: AWS Steps Plugin’s build steps.Pipeline: AWS Steps Plugin 1.41 configures its YAML parser to only instantiate safe types.RCE vulnerability in OpenShift Pipeline PluginSECURITY-1739
/
CVE-2020-2167OpenShift Pipeline Plugin 1.0.56 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types.
This results in a remote code execution (RCE) vulnerability exploitable by users able to provide YAML input files to OpenShift Pipeline Plugin’s build step.OpenShift Pipeline Plugin 1.0.57 configures its YAML parser to only instantiate safe types.RCE vulnerability in Azure Container Service PluginSECURITY-1732
/
CVE-2020-2168Azure Container Service Plugin 1.0.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types.
This results in a remote code execution (RCE) vulnerability exploitable by users able to provide YAML input files to Azure Container Service Plugin’s build step.Azure Container Service Plugin 1.0.2 configures its YAML parser to only instantiate safe types.Reflected XSS vulnerability in Queue cleanup PluginSECURITY-1724
/
CVE-2020-2169A form validation HTTP endpoint in Queue cleanup Plugin 1.3 and earlier does not escape a query parameter displayed in an error message.
This results in a reflected cross-site scripting vulnerability (XSS).Queue cleanup Plugin 1.4 correctly escapes the query parameter.Stored XSS vulnerability in RapidDeploy PluginSECURITY-1676
/
CVE-2020-2170RapidDeploy Plugin 4.2 and earlier does not escape package names in its displayed table of packages obtained from a remote server.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by users able to configure jobs.RapidDeploy Plugin 4.2.1 escapes package names.XXE vulnerability in RapidDeploy PluginSECURITY-1677
/
CVE-2020-2171RapidDeploy Plugin 4.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.This allows a user able to control the input files for the 'RapidDeploy deployment package build' build or post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins master, server-side request forgery, or denial-of-service attacks.RapidDeploy Plugin 4.2.1 disables external entity resolution for its XML parser.SeveritySECURITY-1542 (1):LowSECURITY-1542 (2):LowSECURITY-1676:MediumSECURITY-1677:HighSECURITY-1724:MediumSECURITY-1732:HighSECURITY-1739:HighSECURITY-1741:HighSECURITY-1774:HighSECURITY-1781:MediumSECURITY-1793:MediumSECURITY-1796:MediumAffected VersionsJenkins weekly up to and including
2.227Jenkins LTS up to and including
LTS 2.204.5Artifactory
Pluginup to and including
3.6.0Azure Container Service
Pluginup to and including
1.0.1OpenShift Pipeline
Pluginup to and including
1.0.56Pipeline: AWS Steps
Pluginup to and including
1.40Queue cleanup
Pluginup to and including
1.3RapidDeploy
Pluginup to and including
4.2FixJenkins weekly should be updated to version
2.228Jenkins LTS should be updated to version
LTS 2.204.6 or LTS 2.222.1Artifactory
Pluginshould be updated to version
3.6.1Azure Container Service
Pluginshould be updated to version
1.0.2OpenShift Pipeline
Pluginshould be updated to version
1.0.57Pipeline: AWS Steps
Pluginshould be updated to version
1.41Queue cleanup
Pluginshould be updated to version
1.4RapidDeploy
Pluginshould be updated to version
4.2.1These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated.
软件描述
Jenkins是一个开源软件项目，是基于Java开发的一种持续集成工具，用于监控持续重复的工作，旨在提供一个开放易用的软件平台，使软件的持续集成变成可能。 [1]
评论