BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

Jenkins

Jenkins Security Releases - March 2018

jenkins-2018-03 Mar 1, 2018 Source: Vendor

Jenkins security advisories for March 2018: 12 CVEs, 7 credited researchers.

Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

12 lines
All 12 CVEs 12 Additional recognition 0 Unclaimed only
Showing 1–12 of 12
CVE-2018-1000142 BR2018-0000-041270 SECURITY-261 unclaimed
GitHub Pull Request Builder Plugin stores GitHub access tokens in build.xml
Credited as Steve Marlowe of Cisco ASIG
CVE-2018-1000143 BR2018-0000-041271 SECURITY-262 unclaimed
GitHub Pull Request Builder Plugin stores webhook secret in plain text
Credited as Steve Marlowe of Cisco ASIG
CVE-2018-1000144 BR2018-0000-041272 SECURITY-308 unclaimed
Cucumber Living Documentation Plugin disabled Content-Security-Policy for archived and workspace files
Credited as Daniel Beck, CloudBees, Inc.
CVE-2018-1000145 BR2018-0000-041273 SECURITY-373 unclaimed
Perforce Plugin uses ineffective credentials encryption
Credited as Steve Marlowe of Cisco ASIG
CVE-2018-1000146 BR2018-0000-041274 SECURITY-519 unclaimed
Liquibase Runner Plugin allows users to load arbitrary Java code into controller JVM
Credited as Yoann Dubreuil, CloudBees, Inc.
CVE-2018-1000147 BR2018-0000-041275 SECURITY-536 unclaimed
Perforce Plugin credentials can be obtained by users with Job/Extended Read permission
Credited as Oleg Nenashev, CloudBees, Inc.
CVE-2018-1000148 BR2018-0000-041276 SECURITY-545 unclaimed
Copy To Slave Plugin allows access to arbitrary files on the Jenkins controller file system
Credited as Jesse Glick, CloudBees, Inc.
CVE-2018-1000149 BR2018-0000-041277 SECURITY-630 unclaimed
Ansible Plugin disabled host key verification by default
Credited as Daniel Beck, CloudBees, Inc.
CVE-2018-1000150 BR2018-0000-041278 SECURITY-736 unclaimed
Reverse Proxy Auth persisted authorities cache on disk
Credited as Oleg Nenashev, CloudBees, Inc.
CVE-2018-1000151 BR2018-0000-041279 SECURITY-504 unclaimed
vSphere Plugin does not validate SSL/TLS certificates
Credited as Peter Adkins
CVE-2018-1000152 BR2018-0000-041280 SECURITY-745 unclaimed
CSRF vulnerability and missing permission checks in vSphere Plugin form validation allowed enumerating credentials IDs, capturing credentials, and denial of service
Credited as Daniel Beck, CloudBees, Inc.
CVE-2018-8718 BR2018-0000-041281 SECURITY-774 unclaimed
Mailer Plugin allowed unauthorized users to send test emails
Credited as Hyoungwook Jang, SKinfosec, Inc.