Security Alerts

Your review has been sent successfully
Classification
These posts contain security alerts, including digital loopholes, electronic attacks, technical updates, and they are classified base on the level of severity.

Critical

High

Medium

Low

Jenkins Update

204

Warning Date: 10 March, 2020

Severity Level ● Medium

Warning Number: 2020-1002

Target Sector: All

Description:

Jenkins has released security update to address multiple vulnerabilities in the following products:

  • Git Plugin
    • up to and including 4.2.0
  • Timestamper Plugin
    • up to and including 1.11.1
  • Cobertura Plugin
    • up to and including 1.15
  • Audit Trail Plugin
    • up to and including 3.2
  • P4 Plugin
    • up to and including 1.10.10
  • Logstash Plugin
  • Rundeck Plugin
    • up to and including 3.6.6
  • Zephyr Enterprise Test Management Plugin
    • up to and including 1.9.1
  • Mac Plugin
    • up to and including 1.1.0
  • Repository Connector Plugin
  • Sonar Quality Gates Plugin
  • Subversion Release Manager Plugin
    • up to and including 1.2
  • Backlog Plugin
  • Zephyr for JIRA Test Management Plugin
    • up to and including 1.5
  • OpenShift Deployer Plugin
  • DeployHub Plugin
  • Skytap Cloud CI Plugin
  • Literate Plugin
    • up to and including 1.0
  • CryptoMove Plugin
    • up to and including 0.1.33

Threats:

Attacker could exploit these vulnerabilities by doing the following:

  • XML external entity (XXE) attack
  • Execute arbitrary code
  • Cross-site scripting (XSS) attack.

Best practice and Recommendations:

The CERT team encourages users to review Jenkins security advisory and apply the necessary updates:

Last updated at 10 March, 2020

Rate the content

rate-icon
up icon