Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins

The agent-to-controller security subsystem limits which files on the Jenkins controller can be accessed by agent processes. Multiple vulnerabilities in the file path filtering implementation of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allow agent processes to read and write arbitrary...

com.groupon.jenkins-ci.plugins:dotci (>=1.1.0, <=2.27.0), com.groupon.jenkins-ci.plugins:dotci-dockerpublish (>=1.0.0, <=1.0.3) +7 more potentially affected by CVE-2021-21684 via org.jenkins-ci.plugins:git (2.0.3)

org.jenkins-ci.plugins:git MAVEN version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - com.groupon.jenkins-ci.plugins:dotci =1.1.0, =1.0.0, =1.0.1, =1.1.3, =1.7.2, =1.1.0, =1.0.0, =1.0, =0.16,...

br.com.ingenieux.jenkins.plugins:awseb-deployment-plugin (>=0.1.0, <=0.3.15), br.com.ingenieux.jenkins.plugins:codecommit-url-helper (0.0.1) +10 more potentially affected by CVE-2021-21625 via org.jenkins-ci.plugins:aws-credentials (>=1.9, <=1.24)

org.jenkins-ci.plugins:aws-credentials MAVEN version =1.9, =0.1.0, =1.0, =1.0-beta-1, =1.0-beta-1, =0.3, =1.2.2, =1.0.0, =1.32, =1.40 - org.jenkins-ci.plugins:jobcacher 1.0 Source cves: CVE-2021-21625 Source advisory: GHSA-JWR9-H4JM-C9CH...

containernetworking/plugins vulnerable to MitM attacks

A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters to perform man-in-the-middle MitM attacks. A malicious container can exploit this flaw by sending rogue IPv6 router advertisements to the host or...

GHSA-FX6X-H9G4-56F8 containernetworking/plugins vulnerable to MitM attacks

A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters to perform man-in-the-middle MitM attacks. A malicious container can exploit this flaw by sending rogue IPv6 router advertisements to the host or...

org.jenkins-ci.plugins.workflow:workflow-aggregator (1.12-beta-1), org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (1.12-beta-1) +1 more potentially affected by CVE-2020-2109 via org.jenkins-ci.plugins.workflow:workflow-cps (1.12-beta-1)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 1.12-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregator 1.12-beta-1 -...

Ansible Uses Plugins That Disclose Credentials

Ansible, all ansibleengine-2.x versions and ansibleengine-3.x up to ansibleengine-3.5, was logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed i...

GHSA-PM48-CVV2-29Q5 Ansible Uses Plugins That Disclose Credentials

Ansible, all ansibleengine-2.x versions and ansibleengine-3.x up to ansibleengine-3.5, was logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed i...

org.jenkins-ci.main:jenkins-test-harness (1.637), org.jenkins-ci.main:jenkins-war (1.637) +1 more potentially affected by CVE-2019-10383 via org.jenkins-ci.main:jenkins-core (1.637)

org.jenkins-ci.main:jenkins-core MAVEN version 1.637 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.637 - org.jenkins-ci.main:jenkins-war 1.637 -...

org.jenkins-ci.main:jenkins-test-harness (1.487), org.jenkins-ci.main:jenkins-war (1.487) +3 more potentially affected by CVE-2019-10383 via org.jenkins-ci.main:jenkins-core (1.487)

org.jenkins-ci.main:jenkins-core MAVEN version 1.487 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.487 - org.jenkins-ci.main:jenkins-war 1.487 -...

com.github.bogdanlivadariu:bootstraped-multi-test-results-report (>=0.0.2, <=1.3.0), org.jenkins-ci.main:jenkins-test-harness (1.615) +4 more potentially affected by CVE-2019-10383 via org.jenkins-ci.main:jenkins-core (1.615)

org.jenkins-ci.main:jenkins-core MAVEN version 1.615 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.github.bogdanlivadariu:bootstraped-multi-test-results-report =0.0.2, =1.76, =2.1.2, =2.1.3...

org.jenkins-ci.main:jenkins-test-harness (1.547), org.jenkins-ci.main:jenkins-war (1.547) +1 more potentially affected by CVE-2019-10383 via org.jenkins-ci.main:jenkins-core (1.547)

org.jenkins-ci.main:jenkins-core MAVEN version 1.547 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.547 - org.jenkins-ci.main:jenkins-war 1.547 -...

com.github.bogdanlivadariu:bootstraped-multi-test-results-report (>=1.0.0, <=1.3.4), org.jenkins-ci.main:jenkins-test-harness (1.616) +2 more potentially affected by CVE-2019-10383 via org.jenkins-ci.main:jenkins-core (1.616)

org.jenkins-ci.main:jenkins-core MAVEN version 1.616 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.github.bogdanlivadariu:bootstraped-multi-test-results-report =1.0.0, =1.3.4 -...

com.antelink.reporter.jenkins.plugin:antepediareporter-ci-plugin (>=1.7, <=1.8), org.jenkins-ci.main:jenkins-test-harness (1.536) +3 more potentially affected by CVE-2019-10383 via org.jenkins-ci.main:jenkins-core (1.536)

org.jenkins-ci.main:jenkins-core MAVEN version 1.536 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.antelink.reporter.jenkins.plugin:antepediareporter-ci-plugin =1.7, =1.1, =1.2 Source cves:...

com.moded.extendedchoiceparameter:dynamic_extended_choice_parameter (>=1.0.0, <=1.0.1), org.jenkins-ci.main:jenkins-test-harness (1.548) +7 more potentially affected by CVE-2019-10383 via org.jenkins-ci.main:jenkins-core (1.548)

org.jenkins-ci.main:jenkins-core MAVEN version 1.548 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.moded.extendedchoiceparameter:dynamicextendedchoiceparameter =1.0.0, =4.3, =4.6.1 -...

org.jenkins-ci.main:jenkins-test-harness (1.569), org.jenkins-ci.main:jenkins-war (1.569) +1 more potentially affected by CVE-2019-10383 via org.jenkins-ci.main:jenkins-core (1.569)

org.jenkins-ci.main:jenkins-core MAVEN version 1.569 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.569 - org.jenkins-ci.main:jenkins-war 1.569 -...

GHSA-MQR8-3V8J-46WV Missing Authorization in Jenkins Configuration as Code Plugin

Missing permission checks in Jenkins Configuration as Code Plugin 1.24 and earlier in various HTTP endpoints allowed users with Overall/Read access to access the generated schema and documentation for this plugin containing detailed information about installed plugins...

com.groupon.jenkins-ci.plugins:dotci (>=1.0.0, <=2.27.0), com.groupon.jenkins-ci.plugins:dotci-dockerpublish (>=1.0.0, <=1.0.3) +5 more potentially affected by CVE-2019-10315 via org.jenkins-ci.plugins:github-oauth (>=0.14, <=0.20)

org.jenkins-ci.plugins:github-oauth MAVEN version =0.14, =1.0.0, =1.0.0, =1.0.1, =1.1.3, =1.7.2, =1.0.0, =1.0.0, =1.1.2 Source cves: CVE-2019-10315 Source advisory: OSV:GHSA-PHWV-CRGP-9R69...

Jenkins plugins Multiple Vulnerabilities (2022-04-12)

According to its their self-reported version number, the version of Jenkins plugins running on the remote web server are Jenkins CVS Plugin prior to 2.19.1, Credentials Plugin prior to 1112., Extended Choice Parameter Plugin 346. or earlier, Gerrit Trigger Plugin prior to 2.35.3, Git Parameter...

CVE-2018-20430

GNU Libextractor through 1.8 has an out-of-bounds read vulnerability in the function historyextract in plugins/ole2extractor.c, related to EXTRACTORcommonconverttoutf8 in common/convert.c...