-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2019.3629
                   Jenkins Security Advisory 2019-09-25
                             26 September 2019

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Jenkins
Publisher:         Jenkins
Operating System:  Windows
                   UNIX variants (UNIX, Linux, OSX)
Impact/Access:     Execute Arbitrary Code/Commands -- Existing Account            
                   Cross-site Request Forgery      -- Remote with User Interaction
                   Cross-site Scripting            -- Existing Account            
                   Access Confidential Data        -- Existing Account            
Resolution:        Patch/Upgrade
CVE Names:         CVE-2019-10430 CVE-2019-10429 CVE-2019-10428
                   CVE-2019-10427 CVE-2019-10426 CVE-2019-10425
                   CVE-2019-10424 CVE-2019-10423 CVE-2019-10422
                   CVE-2019-10421 CVE-2019-10420 CVE-2019-10419
                   CVE-2019-10418 CVE-2019-10417 CVE-2019-10416
                   CVE-2019-10415 CVE-2019-10414 CVE-2019-10413
                   CVE-2019-10412 CVE-2019-10411 CVE-2019-10410
                   CVE-2019-10409 CVE-2019-10408 CVE-2019-10407
                   CVE-2019-10406 CVE-2019-10405 CVE-2019-10404
                   CVE-2019-10403 CVE-2019-10402 CVE-2019-10401

Original Bulletin: 
   https://jenkins.io/security/advisory/2019-09-25/

- --------------------------BEGIN INCLUDED TEXT--------------------

Jenkins Security Advisory 2019-09-25

This advisory announces vulnerabilities in the following Jenkins deliverables:

  o Jenkins (core)
  o Aqua MicroScanner Plugin
  o Aqua Security Scanner Plugin
  o Assembla Plugin
  o Azure Event Grid Build Notifier Plugin
  o Call Remote Job Plugin
  o CodeScan Plugin
  o Data Theorem: CI/CD Plugin
  o elOyente Plugin
  o Gem Publisher Plugin
  o Git Changelog Plugin
  o GitLab Logo Plugin
  o Google Calendar Plugin
  o Inedo BuildMaster Plugin Plugin
  o Inedo ProGet Plugin Plugin
  o Kubernetes Pipeline - Arquillian Steps Plugin
  o Kubernetes Pipeline - Kubernetes Steps Plugin
  o Log Parser Plugin
  o NeuVector Vulnerability Scanner Plugin
  o Project Inheritance Plugin
  o vFabric Application Director Plugin
  o Violation Comments to GitLab Plugin

Descriptions

Stored XSS vulnerability in expandable textbox form control

SECURITY-1498 / CVE-2019-10401

Jenkins form controls include an expandable textbox that can transform from a
single-line text box to a multi-line text area.

The implementation of this transformation interpreted the text content of the
form field as HTML. This resulted in a cross-site scripting vulnerability
exploitable by attackers able to control the contents of such
f:expandableTextbox form controls.

Jenkins no longer interprets f:expandableTextbox text content as HTML when
transforming it.

XSS vulnerability in combobox form control

SECURITY-1525 / CVE-2019-10402

Jenkins interpreted items added to f:combobox form controls as HTML. This
resulted in a cross-site scripting vulnerability exploitable by attackers able
to control the contents of f:combobox form controls.

Jenkins no longer interprets items added to a combobox as HTML.

     This might be a breaking change for plugins that relied on the previous,
Note undocumented behavior to add formatting to f:combobox elements. This has
     been removed without replacement. Plugin developers are advised to only
     add plain text entries to f:combobox controls.

Stored XSS vulnerability in SCM tag action tooltip

SECURITY-1537 (1) / CVE-2019-10403

Jenkins did not escape the tag name on the tooltip for tag actions shown in the
build history. This resulted in a cross-site scripting vulnerability
exploitable by attackers able to control the SCM tag name for these actions.

Jenkins now escapes the SCM tag action.

Stored XSS vulnerability in queue item tooltip

SECURITY-1537 (2) / CVE-2019-10404

Jenkins did not escape the reason a queue item is blocked in tooltips. This
resulted in a cross-site scripting vulnerability exploitable by attackers able
to control the reason a queue item is blocked, for example a label expression
that does not match idle executors.

Jenkins now escapes the reason a queue item is blocked in tooltips.

Diagnostic web page exposed Cookie HTTP header

SECURITY-1505 / CVE-2019-10405

Jenkins shows various technical information about the current user on the /
whoAmI URL. The information shown includes HTTP request headers.

This allowed attackers able to exploit another cross-site scripting
vulnerability to obtain the Cookie header's value even if the HttpOnly flag
would prevent direct access via JavaScript.

Jenkins no longer shows the value of the Cookie HTTP header on the /whoAmI URL.

XSS vulnerability in Jenkins URL setting

SECURITY-1471 / CVE-2019-10406

Jenkins did not validate or otherwise limit the possible values administrators
could specify as Jenkins root URL.

This resulted in a cross-site scripting vulnerability exploitable by users with
Overall/Administer permission.

Jenkins now prevents values other than HTTP/HTTPS URLs from being set as
Jenkins root URL. Existing instances with invalid root URLs will behave as if
no root URL was set.

     In case this results in problems, e.g. a valid URL unexpectedly being
Note rejected, set the system property
     jenkins.model.JenkinsLocationConfiguration.disableUrlValidation to true to
     disable this restriction. Learn more about system properties in Jenkins.

Project Inheritance Plugin showed secret environment variables defined in Mask
Passwords Plugin

SECURITY-351 / CVE-2019-10407

Mask Passwords Plugin allows users to define secret environment variables
(typically passwords) to be passed to builds, both globally, and for specific
jobs. These environment variables are expected to not be shown.

Project Inheritance Plugin showed the variable values on its Full Build Flow
view and included them in the metadata download without masking.

Project Inheritance Plugin no longer shows variables contributed from Mask
Password Plugin without masking.

CSRF vulnerability and missing permission check in Project Inheritance Plugin

SECURITY-401 / CVE-2019-10408 (CSRF), CVE-2019-10409 (permission check)

Project Inheritance Plugin allows the creation of projects based on templates
defined in the plugin configuration.

A missing permission check in the HTTP endpoint triggering project creation
allowed users with Overall/Read permission to create these projects.
Additionally, the HTTP endpoint did not require POST requests, resulting in a
CSRF vulnerability.

The HTTP endpoint triggering project creation now requires Item/Create
permission and submission of requests via POST.

Stored XSS vulnerability in Log Parser Plugin

SECURITY-732 / CVE-2019-10410

Log Parser Plugin did not escape an error message shown when log parsing
patterns are invalid. This resulted in a persisted cross-site scripting
vulnerability exploitable by attackers able to control the log parsing rules
configuration, typically users with Job/Configure permission.

Jenkins applies the missing escaping by default since 2.146 and LTS 2.138.2, so
newer Jenkins releases are not affected by this vulnerability.

Log Parser Plugin now escapes all variables displayed in its views.

NeuVector Vulnerability Scanner Plugin stored credentials in plain text

SECURITY-1504 / CVE-2019-10430

NeuVector Vulnerability Scanner Plugin stored registry credentials unencrypted
in its global configuration file
io.jenkins.plugins.neuvector.NeuVectorBuilder.xml on the Jenkins master. These
credentials could be viewed by users with access to the master file system.

NeuVector Vulnerability Scanner Plugin now stores these credentials encrypted.

Aqua MicroScanner Plugin showed plain text credential in configuration form

SECURITY-1507 / CVE-2019-10427

Aqua MicroScanner Plugin stores a token credential in its global Jenkins
configuration.

While the token is stored encrypted on disk, it was transmitted in plain text
as part of the configuration form. This could result in exposure of the token
through browser extensions, cross-site scripting vulnerabilities, and similar
situations.

Aqua MicroScanner Plugin now encrypts the token transmitted to administrators
viewing the global configuration form.

Aqua Security Scanner Plugin showed plain text password in configuration form

SECURITY-1508 / CVE-2019-10428

Aqua Security Scanner Plugin stores a password in its global Jenkins
configuration.

While the password is stored encrypted on disk, it was transmitted in plain
text as part of the configuration form. This could result in exposure of the
password through browser extensions, cross-site scripting vulnerabilities, and
similar situations.

Aqua Security Scanner Plugin now encrypts the password transmitted to
administrators viewing the global configuration form.

Inedo BuildMaster Plugin Plugin showed plain text password in configuration
form

SECURITY-1513 / CVE-2019-10411

Inedo BuildMaster Plugin Plugin stores a service password in its global Jenkins
configuration.

While the password is stored encrypted on disk, it was transmitted in plain
text as part of the configuration form. This could result in exposure of the
password through browser extensions, cross-site scripting vulnerabilities, and
similar situations.

Inedo BuildMaster Plugin Plugin now encrypts the password transmitted to
administrators viewing the global configuration form.

Inedo ProGet Plugin Plugin showed plain text password in configuration form

SECURITY-1514 / CVE-2019-10412

Inedo ProGet Plugin Plugin stores a service password in its global Jenkins
configuration.

While the password is stored encrypted on disk, it was transmitted in plain
text as part of the configuration form. This could result in exposure of the
password through browser extensions, cross-site scripting vulnerabilities, and
similar situations.

Inedo ProGet Plugin Plugin now encrypts the password transmitted to
administrators viewing the global configuration form.

Data Theorem: CI/CD Plugin stored credentials in plain text

SECURITY-1557 / CVE-2019-10413

Data Theorem: CI/CD Plugin stored a proxy password unencrypted in job
config.xml files on the Jenkins master. This password could be viewed by users
with Extended Read permission, or access to the master file system.

Data Theorem: CI/CD Plugin now stores the proxy password encrypted. Existing
jobs need to have their configuration saved for existing plain text proxy
passwords to be overwritten.

Git Changelog Plugin stored credentials in plain text

SECURITY-1574 / CVE-2019-10414

Git Changelog Plugin stored MediaWiki and Jira passwords unencrypted in job
config.xml files on the Jenkins master. These passwords could be viewed by
users with Extended Read permission, or access to the master file system.

Git Changelog Plugin now stores these passwords encrypted. Existing jobs need
to have their configuration saved for existing plain text passwords to be
overwritten.

GitLab Logo Plugin stored credentials in plain text

SECURITY-1575 / CVE-2019-10429

GitLab Logo Plugin stored a private token unencrypted in its global
configuration file org.jenkinsci.plugins.gitlablogo.GitlabLogoProperty.xml on
the Jenkins master. This token could be viewed by users with access to the
master file system.

GitLab Logo Plugin now stores the token encrypted.

Violation Comments to GitLab Plugin stored credentials in plain text

SECURITY-1577 / CVE-2019-10415 (global password), CVE-2019-10416 (job password)

Violation Comments to GitLab Plugin stored API tokens unencrypted in job
config.xml files and its global configuration file
org.jenkinsci.plugins.jvctgl.ViolationsToGitLabGlobalConfiguration.xml on the
Jenkins master. These credentials could be viewed by users with Extended Read
permission, or access to the master file system.

Violation Comments to GitLab Plugin now stores these credentials encrypted.
Existing jobs need to have their configuration saved for existing plain text
credentials to be overwritten.

Script sandbox bypass vulnerability in Kubernetes Pipeline - Kubernetes Steps
Plugin

SECURITY-920 (1) / CVE-2019-10417

Kubernetes Pipeline - Kubernetes Steps Plugin defines a custom whitelist for
all scripts protected by the Script Security sandbox.

This custom whitelist allows the use of methods that can be used to bypass
Script Security sandbox protection. This results in arbitrary code execution on
any Jenkins instance with this plugin installed.

As of publication of this advisory, there is no fix.

Script sandbox bypass vulnerability in Kubernetes Pipeline - Arquillian Steps
Plugin

SECURITY-920 (2) / CVE-2019-10418

Kubernetes Pipeline - Arquillian Steps Plugin defines a custom whitelist for
all scripts protected by the Script Security sandbox.

This custom whitelist allows the use of methods that can be used to bypass
Script Security sandbox protection. This results in arbitrary code execution on
any Jenkins instance with this plugin installed.

As of publication of this advisory, there is no fix.

vFabric Application Director Plugin stores credentials in plain text

SECURITY-1541 / CVE-2019-10419

vFabric Application Director Plugin stores the Application Director password
unencrypted in its global configuration file
jfullam.vfabric.jenkins.plugin.ApplicationDirectorPostBuildDeployer.xml on the
Jenkins master. This password can be viewed by users with access to the master
file system.

As of publication of this advisory, there is no fix.

Assembla Plugin stores credentials in plain text

SECURITY-1543 / CVE-2019-10420

Assembla Plugin stores the Assembla password unencrypted in its global
configuration file jenkins.plugin.assembla.AssemblaProjectProperty.xml on the
Jenkins master. This password can be viewed by users with access to the master
file system.

As of publication of this advisory, there is no fix.

Azure Event Grid Build Notifier Plugin stores credentials in plain text

SECURITY-1544 / CVE-2019-10421

Azure Event Grid Build Notifier Plugin stores the Azure Event Grid secret key
unencrypted in job config.xml files on the Jenkins master. This key can be
viewed by users with Extended Read permission, or access to the master file
system.

As of publication of this advisory, there is no fix.

Call Remote Job Plugin stores credentials in plain text

SECURITY-1548 / CVE-2019-10422

Call Remote Job Plugin stores a password unencrypted in job config.xml files on
the Jenkins master. This password can be viewed by users with Extended Read
permission, or access to the master file system.

As of publication of this advisory, there is no fix.

CodeScan Plugin stores credentials in plain text

SECURITY-1551 / CVE-2019-10423

CodeScan Plugin stores an API key unencrypted in its global configuration file
com.villagechief.codescan.jenkins.CodeScanBuilder.xml on the Jenkins master.
This API key can be viewed by users with access to the master file system.

As of publication of this advisory, there is no fix.

elOyente Plugin stores credentials in plain text

SECURITY-1561 / CVE-2019-10424

elOyente Plugin stores a password unencrypted in its global configuration file
com.technicolor.eloyente.ElOyente.xml on the Jenkins master. This password can
be viewed by users with access to the master file system.

As of publication of this advisory, there is no fix.

Google Calendar Plugin stores credentials in plain text

SECURITY-1572 / CVE-2019-10425

Google Calendar Plugin stores a calendar password unencrypted in job config.xml
files on the Jenkins master. This password can be viewed by users with Extended
Read permission, or access to the master file system.

As of publication of this advisory, there is no fix.

Gem Publisher Plugin stores credentials in plain text

SECURITY-1573 / CVE-2019-10426

Gem Publisher Plugin stores an API key unencrypted in its global configuration
file net.arangamani.jenkins.gempublisher.GemPublisher.xml on the Jenkins
master. This API key can be viewed by users with access to the master file
system.

As of publication of this advisory, there is no fix.

Severity

  o SECURITY-351: Medium
  o SECURITY-401: Medium
  o SECURITY-732: Medium
  o SECURITY-920 (1): High
  o SECURITY-920 (2): High
  o SECURITY-1471: Medium
  o SECURITY-1498: Medium
  o SECURITY-1504: Low
  o SECURITY-1505: Medium
  o SECURITY-1507: Low
  o SECURITY-1508: Low
  o SECURITY-1513: Low
  o SECURITY-1514: Low
  o SECURITY-1525: Medium
  o SECURITY-1537 (1): Medium
  o SECURITY-1537 (2): Medium
  o SECURITY-1541: Low
  o SECURITY-1543: Low
  o SECURITY-1544: Medium
  o SECURITY-1548: Medium
  o SECURITY-1551: Low
  o SECURITY-1557: Medium
  o SECURITY-1561: Low
  o SECURITY-1572: Medium
  o SECURITY-1573: Low
  o SECURITY-1574: Medium
  o SECURITY-1575: Low
  o SECURITY-1577: Medium

Affected Versions

  o Jenkins weekly up to and including 2.196
  o Jenkins LTS up to and including 2.176.3
  o Aqua MicroScanner Plugin up to and including 1.0.7
  o Aqua Security Scanner Plugin up to and including 3.0.17
  o Assembla Plugin up to and including 1.4
  o Azure Event Grid Build Notifier Plugin up to and including 0.1
  o Call Remote Job Plugin up to and including 1.0.21
  o CodeScan Plugin up to and including 0.11
  o Data Theorem: CI/CD Plugin up to and including 1.3
  o elOyente Plugin up to and including 1.3
  o Gem Publisher Plugin up to and including 1.0
  o Git Changelog Plugin up to and including 2.17
  o GitLab Logo Plugin up to and including 1.0.3
  o Google Calendar Plugin up to and including 0.4
  o Inedo BuildMaster Plugin Plugin up to and including 2.4.0
  o Inedo ProGet Plugin Plugin up to and including 1.2
  o Kubernetes Pipeline - Arquillian Steps Plugin up to and including 1.6
  o Kubernetes Pipeline - Kubernetes Steps Plugin up to and including 1.6
  o Log Parser Plugin up to and including 2.0
  o NeuVector Vulnerability Scanner Plugin up to and including 1.5
  o Project Inheritance Plugin up to and including 19.08.01
  o vFabric Application Director Plugin up to and including 1.3
  o Violation Comments to GitLab Plugin up to and including 2.28

Fix

  o Jenkins weekly should be updated to version 2.197
  o Jenkins LTS should be updated to version 2.176.4
  o Aqua MicroScanner Plugin should be updated to version 1.0.8
  o Aqua Security Scanner Plugin should be updated to version 3.0.18
  o Data Theorem: CI/CD Plugin should be updated to version 1.4.0
  o Git Changelog Plugin should be updated to version 2.18
  o GitLab Logo Plugin should be updated to version 1.0.4
  o Inedo BuildMaster Plugin Plugin should be updated to version 2.5.0
  o Inedo ProGet Plugin Plugin should be updated to version 1.3
  o Log Parser Plugin should be updated to version 2.1
  o NeuVector Vulnerability Scanner Plugin should be updated to version 1.6
  o Project Inheritance Plugin should be updated to version 19.08.02
  o Violation Comments to GitLab Plugin should be updated to version 2.29

These versions include fixes to the vulnerabilities described above. All prior
versions are considered to be affected by these vulnerabilities unless
otherwise indicated.

As of publication of this advisory, no fixes are available for the following
plugins:

  o Assembla Plugin
  o Azure Event Grid Build Notifier Plugin
  o Call Remote Job Plugin
  o CodeScan Plugin
  o elOyente Plugin
  o Gem Publisher Plugin
  o Google Calendar Plugin
  o Kubernetes Pipeline - Arquillian Steps Plugin
  o Kubernetes Pipeline - Kubernetes Steps Plugin
  o vFabric Application Director Plugin

Credit

The Jenkins project would like to thank the reporters for discovering and
reporting these vulnerabilities:

  o Daniel Beck, CloudBees, Inc. for SECURITY-401
  o James Holderness, IB Boost for SECURITY-1507, SECURITY-1508, SECURITY-1513,
    SECURITY-1514, SECURITY-1541, SECURITY-1543, SECURITY-1544, SECURITY-1548,
    SECURITY-1551, SECURITY-1557, SECURITY-1561, SECURITY-1572, SECURITY-1573,
    SECURITY-1574, SECURITY-1575, SECURITY-1577
  o Jesse Glick, CloudBees, Inc. for SECURITY-920 (1), SECURITY-920 (2)
  o Jonathan Leitschuh for SECURITY-1505
  o Katherine Hough <khough2@gmu.edu> and Jonathan Bell <bellj@gmu.edu> for
    SECURITY-1471
  o Matt Sicker, CloudBees Inc. and Wadeck Follonier, CloudBees Inc. for
    SECURITY-1498, SECURITY-1525
  o Oleg Nenashev, CloudBees, Inc. for SECURITY-732
  o Wadeck Follonier, CloudBees, Inc. for SECURITY-1537 (1), SECURITY-1537 (2)

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBXYxFy2aOgq3Tt24GAQgB0Q/6AnjY/v4RBWHFN1EWr4GKgEByV3au/Gy9
CwFTQCDqUrE/kSdRfxIQCc84SO2ATucdXTXZi7TtMebCF1WDQFYlXNfyAWO6iTMO
Pfym7hra6z6Pxuu6t2dOknWWoODmmLd0C8X5TNSTLknlsjD0/heauxOhNsAkDNt6
Zw4/iK3IWQIZ/SkXUk5kJWixNd3bffO6aUjzimqofyUO9mQntMMtzZSArBcP0YRT
0qoqhAavOGP2Juov0RN3iBhDwqM7GMESAdoM7MzgErMWQBqLzxZF265Ti0xB501M
bK8xudpKJr8mFBZ/SexXQH8iOZh2+BU04HgA72i2QeC3L+Jj6i5fY7dIAzc5SNgn
bx//8HakK8OC4lsO79lfCyQjT88pBYTDtemEak+9aL9D4Xmyz2D8SBRk3per+b4o
jNgQR/76gbqKoZA3mLCrUoi/Ow8LYjCIxlP9dMgrg5SzQVA6YlZBnWUscYPStxV2
J5FWdxUiXM9YA2+1qxSnaXFKwm6G/nfBWUr1p4GV9dcgwycuiBxe6sBaDWZl1k02
HXsss3ItYIEyTePyorsb2Bu3piVdyRgnowmAnH2birSzT1xCSvCOEl3zfb0yHcUo
qfbgBQckilL5HtaAL7Pfu4C8x2nM/yseQYage05uor+/X44c3jihq3e5xfUfoRap
En+TEdzRMJg=
=FNrp
-----END PGP SIGNATURE-----