The official site for Saudi CERT
Jenkins Update
3008
Warning Date
Severity Level
Warning Number
Target Sector
10 March, 2020
● Medium
2020-1002
All
Description:
Jenkins has released security update to address multiple vulnerabilities in the following products:
- Git Plugin
- up to and including 4.2.0
- Timestamper Plugin
- up to and including 1.11.1
- Cobertura Plugin
- up to and including 1.15
- Audit Trail Plugin
- up to and including 3.2
- P4 Plugin
- up to and including 1.10.10
- Logstash Plugin
- Rundeck Plugin
- up to and including 3.6.6
- Zephyr Enterprise Test Management Plugin
- up to and including 1.9.1
- Mac Plugin
- up to and including 1.1.0
- Repository Connector Plugin
- Sonar Quality Gates Plugin
- Subversion Release Manager Plugin
- up to and including 1.2
- Backlog Plugin
- Zephyr for JIRA Test Management Plugin
- up to and including 1.5
- OpenShift Deployer Plugin
- DeployHub Plugin
- Skytap Cloud CI Plugin
- Literate Plugin
- up to and including 1.0
- CryptoMove Plugin
- up to and including 0.1.33
Threats:
Attacker could exploit these vulnerabilities by doing the following:
- XML external entity (XXE) attack
- Execute arbitrary code
- Cross-site scripting (XSS) attack.
Best practice and Recommendations:
The CERT team encourages users to review Jenkins security advisory and apply the necessary updates:
Rate the content
Share the page
