Jesse Glick

Name of the Vulnerable Software and Affected Versions: Jenkins OpenID Connect Provider Plugin versions 96.vee8ed882ec4d and earlier Description: The issue concerns the generation of build ID Tokens, which uses potentially overridden values of environment variables. This can be exploited by attackers who can configure jobs, allowing them to craft a build ID Token that impersonates a trusted job. This could potentially lead to unauthorized access to external services. Recommendations: For Jenkins OpenID Connect Provider Plugin versions 96.vee8ed882ec4d and earlier, consider disabling the build ID Token generation feature until a patch is available to prevent potential impersonation attacks. Restrict access to job configuration to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Jenkins Reverse Proxy Auth Plugin versions 1.7.3 and earlier **Description** The issue allows attackers with access to the Jenkins controller file system to view the LDAP manager password, which is stored unencrypted in the global config.xml file. **Recommendations** For Jenkins Reverse Proxy Auth Plugin versions 1.7.3 and earlier, update to a version that fixes the storage of the LDAP manager password to prevent unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Jenkins Maven Metadata Plugin versions 2.2 and earlier **Description** The issue is related to a stored cross-site scripting (XSS) vulnerability. It occurs due to the lack of URL validation for the Repository Base URL of List maven artifact versions parameters. This allows an attacker with Item/Configure permission to exploit the vulnerability, potentially leading to a cross-site scripting attack. The vulnerability can be exploited by a remote attacker. **Recommendations** For Jenkins Maven Metadata Plugin versions 2.2 and earlier, update to a version that includes URL validation for the Repository Base URL of List maven artifact versions parameters to prevent stored cross-site scripting (XSS) attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Jenkins GitHub Plugin versions 1.34.4 and earlier **Description** The issue is related to the disclosure of information through inconsistency. It allows a remote attacker to gain unauthorized access to protected information. The problem lies in the use of a non-constant time comparison function when checking whether the provided and computed webhook signatures are equal. This allows attackers to use statistical methods to obtain a valid webhook signature. **Recommendations** For Jenkins GitHub Plugin versions 1.34.4 and earlier, update to version 1.34.5 or later, which uses a constant-time comparison when validating the webhook signature.

**Name of the Vulnerable Software and Affected Versions** Jenkins Pipeline: Groovy Plugin versions 2689.v434009a 31b f1 and earlier **Description** The issue allows loading any Groovy source files on the classpath of Jenkins and Jenkins plugins in sandboxed pipelines. This could potentially be used to bypass sandbox protections if a suitable Groovy source file is available. However, the severity of this issue is considered High due to the potential impact, but successful exploitation is considered very unlikely. The estimated number of potentially affected devices is not provided. **Recommendations** For Jenkins Pipeline: Groovy Plugin versions 2689.v434009a 31b f1 and earlier, update to version 2692.v76b 089ccd026 or later, which restricts which Groovy source files can be loaded in Pipelines. As a temporary workaround, consider restricting access to Groovy source files on the classpath of Jenkins to minimize the risk of exploitation. Plugins can add specific Groovy source files to the allowlist using the new extension point `org.jenkinsci.plugins.workflow.cps.GroovySourceFileAllowlist` if necessary.

**Name of the Vulnerable Software and Affected Versions** Jenkins Pipeline: Shared Groovy Libraries Plugin versions 564.ve62a 4eb b e039 and earlier, except version 2.21.3 **Description** The issue allows attackers who can submit pull requests, but not commit directly to the configured SCM, to change the Pipeline behavior by modifying the definition of a dynamically retrieved library in their pull request. This is possible even if the Pipeline is configured to not trust them. The vulnerability exploits the `library` step with a `retriever` argument pointing to a library in the current build's repository and branch. **Recommendations** For Jenkins Pipeline: Shared Groovy Libraries Plugin versions 564.ve62a 4eb b e039 and earlier, except version 2.21.3, update to a version that includes the fix, such as Pipeline: Deprecated Groovy Libraries Plugin 566.vd0a a 3334a 555 or version 2.21.3, which aborts library retrieval if the library would be retrieved from the same repository and revision as the current build, and the revision being built is untrusted. For version 2.21.3, no additional action is required as it already includes the necessary protection. As a temporary workaround, consider restricting the use of the `library` step with a `retriever` argument to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Jenkins versions 2.274 and earlier Jenkins LTS versions 2.263.1 and earlier **Description** The issue results from the failure to escape notification bar response contents, leading to a cross-site scripting (XSS) vulnerability. This vulnerability can be exploited by attackers who can influence the contents of the notification bar, typically shown after form submissions via the Apply button. **Recommendations** For Jenkins versions 2.274 and earlier, update to version 2.275 or later. For Jenkins LTS versions 2.263.1 and earlier, update to version 2.263.2 or later.

**Name of the Vulnerable Software and Affected Versions** Jenkins versions 2.274 and earlier Jenkins LTS versions 2.263.1 and earlier **Description** The issue results from the failure to escape button labels in the Jenkins UI, leading to a cross-site scripting (XSS) vulnerability. This vulnerability can be exploited by attackers who have the ability to control button labels. For example, buttons with user-controlled labels, such as those in the Pipeline `input` step, can be used to exploit this issue. **Recommendations** For Jenkins versions 2.274 and earlier, update to version 2.275 or later to resolve the issue. For Jenkins LTS versions 2.263.1 and earlier, update to version 2.263.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Jenkins versions 2.274 and earlier, LTS versions 2.263.1 and earlier **Description** The issue results in a stored cross-site scripting (XSS) vulnerability, which is exploitable by attackers able to specify display names or IDs of item types shown on the New Item page. This occurs because display names and IDs of item types are not properly escaped. As of the publication of this advisory, the Jenkins security team is not aware of any plugins published via the Jenkins project update center that allow doing this. **Recommendations** For Jenkins versions 2.274 and earlier, update to version 2.275 or later. For LTS versions 2.263.1 and earlier, update to version 2.263.2 or later.

**Name of the Vulnerable Software and Affected Versions** Jenkins Copy Artifact Plugin versions 1.43.1 and earlier **Description** The issue arises from improper permission checks, allowing attackers to copy artifacts from jobs they have no permission to access. This is particularly concerning for attackers with Job/Configure permission, as they can configure jobs to copy artifacts from restricted jobs. The estimated number of potentially affected devices worldwide is not available. **Recommendations** For Jenkins Copy Artifact Plugin versions 1.43.1 and earlier, update to version 1.44 or later. After updating, switch from "Migration mode" to "Production mode" to enable the additional protections, noting that this may cause existing jobs to fail to copy artifacts.

**Name of the Vulnerable Software and Affected Versions** Jenkins Google OAuth Credentials Plugin version 0.9 and earlier **Description** The issue allows attackers who can configure jobs and credentials in Jenkins to obtain the contents of any file on the Jenkins master due to an arbitrary file read vulnerability. **Recommendations** For Jenkins Google OAuth Credentials Plugin version 0.9 and earlier, update to a version later than 0.9 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Jenkins Puppet Enterprise Pipeline versions 1.3.1 and earlier **Description** The issue allows attackers to execute arbitrary code if they can execute Script Security protected scripts, due to unsafe values specified in the custom Script Security whitelist. **Recommendations** For Jenkins Puppet Enterprise Pipeline versions 1.3.1 and earlier, update to a version later than 1.3.1 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Jenkins Kubernetes :: Pipeline :: Kubernetes Steps Plugin (affected versions not specified) **Description** The issue concerns a custom whitelist for script security in the Jenkins Kubernetes :: Pipeline :: Kubernetes Steps Plugin, which allowed attackers to invoke arbitrary methods and bypass typical sandbox protection. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Jenkins Kubernetes :: Pipeline :: Arquillian Steps Plugin (affected versions not specified) **Description** The issue allows attackers to invoke arbitrary methods, bypassing typical sandbox protection, due to a custom whitelist for script security provided by the plugin. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Jenkins Simple Travis Pipeline Runner Plugin versions 1.0 and earlier **Description** The issue allows attackers to execute arbitrary code by bypassing the Script Security sandbox protection. This is due to the plugin specifying unsafe values in its custom Script Security whitelist. The custom list of pre-approved signatures for scripts protected by the Script Security sandbox enables the use of methods that can bypass protection, resulting in arbitrary code execution on any Jenkins instance with this plugin installed. **Recommendations** For Jenkins Simple Travis Pipeline Runner Plugin versions 1.0 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Jenkins Amazon EC2 Plugin versions 1.43 and earlier **Description** The issue concerns the Jenkins Amazon EC2 Plugin, which wrote the beginning of private keys to the Jenkins system log. This could potentially expose sensitive information. The problem has been addressed, and the log message no longer includes the beginning of the private key. **Recommendations** For Jenkins Amazon EC2 Plugin versions 1.43 and earlier, update to a version where the log message no longer includes the beginning of the private key to prevent potential exposure of sensitive information.

**Name of the Vulnerable Software and Affected Versions** Jenkins Google Kubernetes Engine Plugin versions 0.6.2 and earlier **Description** The issue concerns the creation of a temporary file containing a temporary access token in the project workspace, which could be accessed by users with Job/Read permission. This temporary file was initially created in the project workspace but is now created outside the regular project workspace. **Recommendations** For Jenkins Google Kubernetes Engine Plugin versions 0.6.2 and earlier, consider updating to a version where the temporary file is created outside the regular project workspace to minimize access to the temporary access token. As a temporary workaround, consider restricting access to the project workspace for users with Job/Read permission until a more secure version is available.

**Name of the Vulnerable Software and Affected Versions** Jenkins Pipeline: Shared Groovy Libraries Plugin versions 2.14 and earlier **Description** A missing permission check in the plugin allowed users with Overall/Read access to obtain limited information about the content of SCM repositories referenced by global libraries. **Recommendations** For versions 2.14 and earlier, update to a version later than 2.14 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Jenkins Maven Integration Plugin versions 3.3 and earlier **Description** The issue potentially reveals sensitive build variables in the build log because build log decorators are not applied to module builds. **Recommendations** For Jenkins Maven Integration Plugin versions 3.3 and earlier, update to a version that applies build log decorators to module builds to prevent sensitive build variables from being revealed in the build log.

**Name of the Vulnerable Software and Affected Versions** Jenkins versions 2.185 and earlier, LTS 2.176.1 and earlier **Description** A vulnerability in the Stapler web framework allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information. **Recommendations** For Jenkins versions 2.185 and earlier, update to a version later than 2.185 to resolve the issue. For Jenkins LTS 2.176.1 and earlier, update to a version later than 2.176.1 to resolve the issue.