Daniel Beck
2018-12-05 09:18:04 UTC
Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software. The following
releases contain fixes for security vulnerabilities:
* Jenkins weekly 2.154
* Jenkins LTS 2.138.4
* Jenkins LTS 2.150.1
Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:
https://jenkins.io/security/advisory/2018-12-05/
We provide advance notification for security updates on this mailing list:
https://groups.google.com/d/forum/jenkinsci-advisories
If you discover security vulnerabilities in Jenkins, please report them as
described here:
https://jenkins.io/security/#reporting-vulnerabilities
---
SECURITY-595
Jenkins uses the Stapler web framework for HTTP request handling.
Stapler’s basic premise is that it uses reflective access to code
elements matching its naming conventions. For example, any public method
whose name starts with get, and that has a String, int, long, or no
argument can be invoked this way on objects that are reachable through
these means. As these naming conventions closely match common code
patterns in Java, accessing crafted URLs could invoke methods never
intended to be invoked this way.
The Stapler web framework has been extended with a Service Provider
Interface (SPI) that allows methods and fields to be excluded from routing.
The implementation of that SPI in Jenkins now restricts which getter
methods, do* action methods, and fields can be invoked reflectively by
Stapler.
SECURITY-1072
The fix for SECURITY-499 introduced a mechanism that renamed user
directories on disk as a user with an unsafe user name (user ID) is loaded.
Insufficient input validation allowed attackers to rename such user
directories even for users with a safe user name by submitting a crafted
user name when attempting to log in, even with an invalid password. Doing
so prevented users from logging in successfully afterwards.
Jenkins no longer uses directory names as a reference for user names,
making the on-load migration of user records unnecessary. Instead, the
new file users/users.xml is used to map user names to the directories
containing the user metadata.
SECURITY-904
The file browser used for workspaces, archived artifacts, and
$JENKINS_HOME/userContent/ followed symbolic links to locations outside
the directory being browsed.
While builds typically have access to the file system outside the
workspace allocated by Jenkins, this should not extend to beyond the
execution of a build on that agent. Notably, the configuration may have
been changed to not allow a build to run on a given agent, but the
workspace used during the previous execution still exists, and could
allow browsing the file system outside the workspace.
Neither browsing through the UI nor downloading directory content as a
ZIP file allow accessing directories and files outside the workspace
anymore.
SECURITY-1193
The form validation for cron expressions (e.g. "Poll SCM", "Build
periodically") could enter infinite loops when cron expressions only
matching certain rare dates were entered, blocking request handling
threads indefinitely.
the world to reliably build, test, and deploy their software. The following
releases contain fixes for security vulnerabilities:
* Jenkins weekly 2.154
* Jenkins LTS 2.138.4
* Jenkins LTS 2.150.1
Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:
https://jenkins.io/security/advisory/2018-12-05/
We provide advance notification for security updates on this mailing list:
https://groups.google.com/d/forum/jenkinsci-advisories
If you discover security vulnerabilities in Jenkins, please report them as
described here:
https://jenkins.io/security/#reporting-vulnerabilities
---
SECURITY-595
Jenkins uses the Stapler web framework for HTTP request handling.
Stapler’s basic premise is that it uses reflective access to code
elements matching its naming conventions. For example, any public method
whose name starts with get, and that has a String, int, long, or no
argument can be invoked this way on objects that are reachable through
these means. As these naming conventions closely match common code
patterns in Java, accessing crafted URLs could invoke methods never
intended to be invoked this way.
The Stapler web framework has been extended with a Service Provider
Interface (SPI) that allows methods and fields to be excluded from routing.
The implementation of that SPI in Jenkins now restricts which getter
methods, do* action methods, and fields can be invoked reflectively by
Stapler.
SECURITY-1072
The fix for SECURITY-499 introduced a mechanism that renamed user
directories on disk as a user with an unsafe user name (user ID) is loaded.
Insufficient input validation allowed attackers to rename such user
directories even for users with a safe user name by submitting a crafted
user name when attempting to log in, even with an invalid password. Doing
so prevented users from logging in successfully afterwards.
Jenkins no longer uses directory names as a reference for user names,
making the on-load migration of user records unnecessary. Instead, the
new file users/users.xml is used to map user names to the directories
containing the user metadata.
SECURITY-904
The file browser used for workspaces, archived artifacts, and
$JENKINS_HOME/userContent/ followed symbolic links to locations outside
the directory being browsed.
While builds typically have access to the file system outside the
workspace allocated by Jenkins, this should not extend to beyond the
execution of a build on that agent. Notably, the configuration may have
been changed to not allow a build to run on a given agent, but the
workspace used during the previous execution still exists, and could
allow browsing the file system outside the workspace.
Neither browsing through the UI nor downloading directory content as a
ZIP file allow accessing directories and files outside the workspace
anymore.
SECURITY-1193
The form validation for cron expressions (e.g. "Poll SCM", "Build
periodically") could enter infinite loops when cron expressions only
matching certain rare dates were entered, blocking request handling
threads indefinitely.