UPDATE Jenkins Plugins: CVSS (Max): 8.8
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2024.2862.2
Jenkins Security Advisory 2024-05-02
9 May 2024
===========================================================================
AusCERT Security Bulletin Summary
———————————
Product: Jenkins Plugins
Publisher: Jenkins
Operating System: UNIX variants (UNIX, Linux, OSX)
Resolution: Patch/Upgrade
CVE Names: CVE-2024-34144 CVE-2024-34146 CVE-2024-34147
CVE-2024-34148
Original Bulletin:
https://www.jenkins.io/security/advisory/2024-05-02/
Comment: CVSS (Max): 8.8 CVE-2024-34144 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS Source: Jenkins
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Revision History: May 9 2024: Updated CVSS max score
May 08 2024: Initial Release
– ————————–BEGIN INCLUDED TEXT——————–
Jenkins Security Advisory 2024-05-02
This advisory announces vulnerabilities in the following Jenkins deliverables:
o Git server Plugin
o Script Security Plugin
o Subversion Partial Release Manager Plugin
o Telegram Bot Plugin
Descriptions
Multiple sandbox bypass vulnerabilities in Script Security Plugin
SECURITY-3341 / CVE-2024-34144 (crafted constructor bodies), CVE-2024-34145
(sandbox-defined classes)
Severity (CVSS): High
Affected plugin: script-security
Description:
Script Security Plugin provides a sandbox feature that allows low privileged
users to define scripts, including Pipelines, that are generally safe to
execute. Calls to code defined inside a sandboxed script are intercepted, and
various allowlists are checked to determine whether the call is to be allowed.
Multiple sandbox bypass vulnerabilities exist in Script Security Plugin
1335.vf07d9ce377a_e and earlier:
o Crafted constructor bodies that invoke other constructors can be used to
construct any subclassable type via implicit casts.
o Sandbox-defined Groovy classes that shadow specific non-sandbox-defined
classes can be used to construct any subclassable type.
These vulnerabilities allow attackers with permission to define and run
sandboxed scripts, including Pipelines, to bypass the sandbox protection and
execute arbitrary code in the context of the Jenkins controller JVM.
These issues are caused by an incomplete fix of SECURITY-2824.
Script Security Plugin 1336.vf33a_a_9863911 has additional restrictions and
sanity checks to ensure that super constructors cannot be constructed without
being intercepted by the sandbox:
o Calls to to other constructors using this are now intercepted by the
sandbox.
o Classes in packages that can be shadowed by Groovy-defined classes are no
longer ignored by the sandbox when intercepting super constructor calls.
Missing permission check in Git server Plugin
SECURITY-3342 / CVE-2024-34146
Severity (CVSS): Medium
Affected plugin: git-server
Description:
Git server Plugin 114.v068a_c7cc2574 and earlier does not perform a permission
check for read access to a Git repository over SSH.
This allows attackers with a previously configured SSH public key but lacking
Overall/Read permission to access Git repositories.
Git server Plugin 117.veb_68868fa_027 requires Overall/Read permission to
access Git repositories over SSH.
Token stored in plain text by Telegram Bot Plugin
SECURITY-3294 / CVE-2024-34147
Severity (CVSS): Low
Affected plugin: telegram-notifications
Description:
Telegram Bot Plugin 1.4.0 and earlier stores the Telegram Bot token unencrypted
in its global configuration file
jenkinsci.plugins.telegrambot.TelegramBotGlobalConfiguration.xml on the Jenkins
controller as part of its configuration.
This token can be viewed by users with access to the Jenkins controller file
system.
As of publication of this advisory, there is no fix. Learn why we announce
this.
Security protection disabled by Subversion Partial Release Manager Plugin
SECURITY-3331 / CVE-2024-34148
Severity (CVSS): Medium
Affected plugin: svn-partial-release-mgr
Description:
Subversion Partial Release Manager Plugin 1.0.1 and earlier programmatically
sets the Java system property
hudson.model.ParametersAction.keepUndefinedParameters whenever a build is
triggered from a release tag with the ‘Svn-Partial Release Manager’ SCM. Doing
so disables the fix for SECURITY-170 / CVE-2016-3721.
As of publication of this advisory, there is no fix. Learn why we announce
this.
Severity
o SECURITY-3294: Low
o SECURITY-3331: Medium
o SECURITY-3341: High
o SECURITY-3342: Medium
Affected Versions
o Git server Plugin up to and including 114.v068a_c7cc2574
o Script Security Plugin up to and including 1335.vf07d9ce377a_e
o Subversion Partial Release Manager Plugin up to and including 1.0.1
o Telegram Bot Plugin up to and including 1.4.0
Fix
o Git server Plugin should be updated to version 117.veb_68868fa_027
o Script Security Plugin should be updated to version 1336.vf33a_a_9863911
These versions include fixes to the vulnerabilities described above. All prior
versions are considered to be affected by these vulnerabilities unless
otherwise indicated.
As of publication of this advisory, no fixes are available for the following
plugins:
o Subversion Partial Release Manager Plugin
o Telegram Bot Plugin
Learn why we announce these issues.
Credit
The Jenkins project would like to thank the reporters for discovering and
reporting these vulnerabilities:
o Daniel Beck, CloudBees, Inc. for SECURITY-3331, SECURITY-3342
o Devin Nusbaum, CloudBees, Inc. for SECURITY-3341
o Surya Dev Singh Rawal , Siemens-Healthineers Pvt Ltd for SECURITY-3294
– ————————–END INCLUDED TEXT———————-
You have received this e-mail bulletin as a result of your organisation’s
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT’s members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation’s
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author’s website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================Security BulletinsRead More