Jenkins Releases Patches for High-Severity Vulnerabilities in Multiple Plugins

Jenkins, the popular open-source automation server, has recently announced the availability of patches to address high- and medium-severity vulnerabilities impacting several plugins. These patches are crucial for maintaining the security and integrity of Jenkins installations. Among the vulnerabilities, three high-severity cross-site request forgery (CSRF) and cross-site scripting (XSS) issues have been identified in the Folders, Flaky Test Handler, and Shortcut Job plugins.

High-severity vulnerabilities and patches

The Folders plugin, specifically versions 6.846.v23698686f0f6 and earlier, contains a high-severity vulnerability. This flaw stems from the fact that no POST requests were required for an HTTP endpoint, leading to CSRF attacks. Jenkins has addressed this issue in the latest patch.

The Flaky Test Handler plugin, versions 1.2.2 and earlier, suffers from a high-severity XSS vulnerability. The plugin fails to escape JUnit test contents when displayed in the Jenkins UI, thereby enabling attackers to execute XSS attacks. The recent patch ensures proper sanitization and mitigation of this vulnerability.

Versions 0.4 and earlier of the Shortcut Job plugin exhibit an XSS (cross-site scripting) flaw. This arises from the plugin’s failure to adequately escape the shortcut redirection URL. The vulnerability allows attackers to inject malicious code into the Jenkins UI, posing a significant security risk. The latest patch rectifies this flaw.

Furthermore, an additional high-severity XSS vulnerability has surfaced in the Docker Swarm plugin. Versions 1.11 and earlier of this plugin do not adequately sanitize values returned from Docker before they are inserted into the Docker Swarm Dashboard view. This vulnerability has been promptly addressed by Jenkins’ latest patch.

Medium-severity vulnerabilities and patches

Jenkins has also identified and addressed medium-severity vulnerabilities in various plugins, including:

1. Folders Plugin:
Apart from the high-severity vulnerability mentioned earlier, this plugin is susceptible to information disclosure, CSRF attacks, and HTML injection. Jenkins has provided patches to effectively mitigate these risks.

2. Config File Provider Plugin:
The Config File Provider plugin has vulnerabilities that may lead to credential leaks and CSRF attacks. Jenkins has released patches to address these issues, ensuring user credentials remain secure.

3. Node.js Plugin:
The Node.js plugin, if left unpatched, could result in information disclosure and CSRF attacks. The latest update resolves these vulnerabilities, safeguarding sensitive data.

4. Blue Ocean Plugin:
Another plugin affected by CSRF attacks and potential credential ID enumeration is Blue Ocean. Jenkins’ latest patches address these medium-severity vulnerabilities.

5. Fortify Plugin:
The Fortify plugin possesses vulnerabilities that could result in information disclosure and CSRF attacks. The patches offered by Jenkins effectively address these risks.

6. Delphix Plugin:
Similar to the other plugins mentioned, the Delphix plugin has medium-severity vulnerabilities that could lead to information disclosure and CSRF attacks. Jenkins’ patches ensure the plugin’s functionality remains secure.

Medium-severity vulnerabilities without patches

However, Jenkins warns that three medium-severity vulnerabilities in specific plugins have yet to receive patches. These plugins include the Maven Artifact ChoiceListProvider (Nexus), Gogs, and Favorite View plugins. These vulnerabilities may potentially expose credentials, disclose sensitive information, or facilitate CSRF attacks. Users are advised to remain vigilant and consider appropriate mitigating measures until patches become available.

Low-severity vulnerabilities and patches

Lastly, Jenkins has also addressed a low-severity vulnerability in the Tuleap Authentication plugin. The vulnerability allowed attackers to obtain a valid authentication token. This security flaw has been fixed in the latest patch, ensuring the plugin’s functionality remains secure.

Jenkins has demonstrated its commitment to proactively addressing vulnerabilities by releasing patches for high- and medium-severity security flaws in multiple plugins. However, users are urged to stay vigilant and apply the necessary patches promptly to ensure the utmost security of their Jenkins installations. Additionally, awareness of the three medium-severity vulnerabilities without patches is vital, and users should take extra precautions to mitigate potential risks. By staying proactive in addressing security concerns, the Jenkins community can continue to rely on a secure and robust automation server.

Explore more

D365 Supply Chain Tackles Key Operational Challenges

Imagine a mid-sized manufacturer struggling to keep up with fluctuating demand, facing constant stockouts, and losing customer trust due to delayed deliveries, a scenario all too common in today’s volatile supply chain environment. Rising costs, fragmented data, and unexpected disruptions threaten operational stability, making it essential for businesses, especially small and medium-sized enterprises (SMBs) and manufacturers, to find ways to

Cloud ERP vs. On-Premise ERP: A Comparative Analysis

Imagine a business at a critical juncture, where every decision about technology could make or break its ability to compete in a fast-paced market, and for many organizations, selecting the right Enterprise Resource Planning (ERP) system becomes that pivotal choice—a decision that impacts efficiency, scalability, and profitability. This comparison delves into two primary deployment models for ERP systems: Cloud ERP

Selecting the Best Shipping Solution for D365SCM Users

Imagine a bustling warehouse where every minute counts, and a single shipping delay ripples through the entire supply chain, frustrating customers and costing thousands in lost revenue. For businesses using Microsoft Dynamics 365 Supply Chain Management (D365SCM), this scenario is all too real when the wrong shipping solution disrupts operations. Choosing the right tool to integrate with this powerful platform

How Is AI Reshaping the Future of Content Marketing?

Dive into the future of content marketing with Aisha Amaira, a MarTech expert whose passion for blending technology with marketing has made her a go-to voice in the industry. With deep expertise in CRM marketing technology and customer data platforms, Aisha has a unique perspective on how businesses can harness innovation to uncover critical customer insights. In this interview, we

Why Are Older Job Seekers Facing Record Ageism Complaints?

In an era where workforce diversity is often championed as a cornerstone of innovation, a troubling trend has emerged that threatens to undermine these ideals, particularly for those over 50 seeking employment. Recent data reveals a staggering surge in complaints about ageism, painting a stark picture of systemic bias in hiring practices across the U.S. This issue not only affects