The official site for Saudi CERT
Jenkins Update
2598
Warning Date
Severity Level
Warning Number
Target Sector
5 November, 2020
● High
2020-2013
All
Description:
Jenkins has released security update to address multiple vulnerabilities in the following deliverables:
- Active Directory Plugin
- up to and including 2.19
- Ansible Plugin
- up to and including 1.0
- AppSpider Plugin
- up to and including 1.0.12
- AWS Global Configuration Plugin
- up to and including 1.5
- Azure Key Vault Plugin
- up to and including 2.0
- FindBugs Plugin
- up to and including 5.0.0
- Kubernetes Plugin
- up to and including 1.27.3
- Mail Commander Plugin for Jenkins-ci Plugin
- up to and including 1.0.0
- Mercurial Plugin
- up to and including 2.11
- SQLPlus Script Runner Plugin
- up to and including 2.0.12
- Static Analysis Utilities Plugin
- up to and including 1.96
- Subversion Plugin
- up to and including 2.13.1
- Visualworks Store Plugin
- up to and including 1.1.3
- VMware Lab Manager Slaves Plugin
- up to and including 0.2.8
Threats:
Attacker could exploit these vulnerabilities by doing the following:
- Cross-site scripting (XSS) attack
- XML external entity (XXE) attack
- Missing permission check
- Log in to Jenkins as any user by providing an empty password
- View users unencrypted passwords
Best practice and Recommendations:
The CERT team encourages users to review Jenkins security advisory and apply the necessary updates:
Rate the content
Share the page
